services / Azure / Microsoft Sentinel setting

A Microsoft Sentinel workspace setting toggling detection features such as UEBA, anomalies, and entity-behavior (EyesOn) capabilities.

These settings enable whole detection features; turning them off removes coverage across the workspace, so the resource type is HIGH.

Microsoft.​SecurityInsights/​settings/​delete

Deleting a setting turns off the detection feature it configured, blinding the SOC to the behaviors that feature covered.

Risks

1. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links