services / Azure / Microsoft Sentinel onboarding state

The onboarding state marking a Log Analytics workspace as enabled for Microsoft Sentinel, gating whether the SIEM is active for that workspace.

The onboarding state controls whether Sentinel runs on a workspace at all; removing it offboards the SIEM, so the resource type is HIGH.

Microsoft.​SecurityInsights/​onboardingStates/​write

Altering the onboarding state can change Sentinel's enablement on a workspace, a lever toward disabling the SIEM.

Risks

1. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links