services / Azure / Microsoft Sentinel threat intelligence bulk delete

Bulk-deletes threat-intelligence objects in Microsoft Sentinel in a single operation.

TI is a detection input; bulk removal degrades coverage at scale but does not disable the platform, so this is MEDIUM.

Microsoft.​SecurityInsights/​threatintelligence/​bulkDelete/​action

Bulk-deleting threat intelligence strips indicators from the SIEM en masse, degrading detection of known-malicious infrastructure at scale.

Risks

1. Defense destruction (EVASION)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links