azure-monitor-delete-log-profile
Delete the subscription-level Activity Log export profile (legacy Microsoft.Insights/logProfiles), stopping archive of all ARM management-plane events for the entire subscription.
match (effective permission)
{
"action": "Microsoft.Insights/logProfiles/delete",
"scope_type": "subscription"
}
emit
| source type | Identity |
|---|---|
| target type | LoggingService |
| source | <principal> |
| target | <log profile (LoggingService node) at subscription scope> |
| permissions | Microsoft.Insights/logProfiles/delete |
| conditions | iam_permission deny_assignment |
| state logic | ACTIVE when the principal holds Microsoft.Insights/logProfiles/delete at subscription scope with no deny assignment. Log profiles are subscription-scoped; the permission must be at subscription or management-group scope. BLOCKED if a deny assignment covers logProfiles/delete. POTENTIAL if the subscription has no log profile configured (check presence before emitting — many modern tenants have migrated entirely to subscription-scope diagnostic settings and have no log profile). |
Narrative
{principal.name} can delete the log profile {target.name} (Microsoft.Insights/logProfiles/delete), stopping export of the subscription-level Activity Log to the configured storage account or Event Hub. All ARM management-plane events in the subscription go unarchived until a new profile or diagnostic setting is created. This is a subscription-wide cover-tracks primitive.
Raw rule rules/derived/azure/monitor.yaml
id: azure-monitor-delete-log-profile
emits: CanDelete
description: Delete the subscription-level Activity Log export profile (legacy Microsoft.Insights/logProfiles),
stopping archive of all ARM management-plane events for the entire subscription.
match_effective_permission:
action: Microsoft.Insights/logProfiles/delete
scope_type: subscription
emit:
source_type: Identity
target_type: LoggingService
source: <principal>
target: <log profile (LoggingService node) at subscription scope>
permissions:
- Microsoft.Insights/logProfiles/delete
conditions:
- iam_permission
- deny_assignment
state_logic: "ACTIVE when the principal holds Microsoft.Insights/logProfiles/delete at subscription\
\ scope with no deny assignment. Log profiles are subscription-scoped; the permission must be at subscription\
\ or management-group scope. BLOCKED if a deny assignment covers logProfiles/delete. POTENTIAL if\
\ the subscription has no log profile configured (check presence before emitting \u2014 many modern\
\ tenants have migrated entirely to subscription-scope diagnostic settings and have no log profile)."
confidence: 0.92
derived_from:
- 'effective permission: Microsoft.Insights/logProfiles/delete'
false_positive_note: "DEFENSE EVASION ONLY \u2014 no access gained. Log profiles are the LEGACY subscription\
\ Activity Log export mechanism (superseded by subscription-scope diagnostic settings). Many tenants\
\ have migrated and have no log profile; emit POTENTIAL if no profile is confirmed present, ACTIVE\
\ only if a log profile node exists. Do not emit for tenants where the subscription Activity Log is\
\ exported only via diagnostic settings (a separate pipeline unaffected by logProfiles deletion).\
\ Never chain to access edges."
narrative: '{principal.name} can delete the log profile {target.name} (Microsoft.Insights/logProfiles/delete),
stopping export of the subscription-level Activity Log to the configured storage account or Event
Hub. All ARM management-plane events in the subscription go unarchived until a new profile or diagnostic
setting is created. This is a subscription-wide cover-tracks primitive.'