{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-105-review-vm-extension-authority-before-granting-log-analytics-contributor/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-105-review-vm-extension-authority-before-granting-log-analytics-contributor/", "slug": "dse-20260917-105-review-vm-extension-authority-before-granting-log-analytics-contributor", "url": "https://update.dsesecurity.com/updates/dse-20260917-105-review-vm-extension-authority-before-granting-log-analytics-contributor/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-105-review-vm-extension-authority-before-granting-log-analytics-contributor.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-105-review-vm-extension-authority-before-granting-log-analytics-contributor/" }, "title": "Review VM-extension authority before granting Log Analytics Contributor", "summary": "A monitoring-role assignment can include operational control beyond reading logs.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:15+00:00", "modified_at": "2026-09-17T16:42:35+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 211, "potentially_affected": "Use this review when a team requests Log Analytics Contributor for a person or automation identity. Identify the requested monitoring tasks, proposed assignment scope and machines within that scope. Assess effective inherited permissions as well as the proposed new grant.", "dse_recommendation": "DSE recommends asking the monitoring and VM owners to review the requested tasks together.", "primary_source": { "name": "Manage access to Log Analytics workspaces - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/manage-access", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft lists adding VM extensions among the operations included in Log Analytics Contributor. The same guidance warns that permission to add an extension can be used to gain full control of a VM. The role therefore requires review beyond a requester’s need to read monitoring data. Microsoft Learn.

\n

Applicability

\n

Use this review when a team requests Log Analytics Contributor for a person or automation identity. Identify the requested monitoring tasks, proposed assignment scope and machines within that scope. Assess effective inherited permissions as well as the proposed new grant.

\n

DSE recommendation

\n

DSE recommends asking the monitoring and VM owners to review the requested tasks together. Separate read-only investigation from tasks that change machine configuration. Select a role and scope that fit the approved work, and document any accepted extension-management authority explicitly. Avoid approving a broad role merely because its name sounds limited to analytics.

\n

Verification

\n

Inspect the resulting effective permissions at the intended scope. Use permitted read operations to confirm the monitoring workflow and review whether extension-write authority is present where expected. Do not install an extension on a production machine merely to demonstrate the risk. Retain the permission analysis, assignment identifiers and owner decision for subsequent access reviews.

\n

Official references

\n

Microsoft Learn: Manage access to Log Analytics workspaces.

", "content_text": "Source facts\nMicrosoft lists adding VM extensions among the operations included in Log Analytics Contributor. The same guidance warns that permission to add an extension can be used to gain full control of a VM. The role therefore requires review beyond a requester’s need to read monitoring data. Microsoft Learn.\nApplicability\nUse this review when a team requests Log Analytics Contributor for a person or automation identity. Identify the requested monitoring tasks, proposed assignment scope and machines within that scope. Assess effective inherited permissions as well as the proposed new grant.\nDSE recommendation\nDSE recommends asking the monitoring and VM owners to review the requested tasks together. Separate read-only investigation from tasks that change machine configuration. Select a role and scope that fit the approved work, and document any accepted extension-management authority explicitly. Avoid approving a broad role merely because its name sounds limited to analytics.\nVerification\nInspect the resulting effective permissions at the intended scope. Use permitted read operations to confirm the monitoring workflow and review whether extension-write authority is present where expected. Do not install an extension on a production machine merely to demonstrate the risk. Retain the permission analysis, assignment identifiers and owner decision for subsequent access reviews.\nOfficial references\nMicrosoft Learn: Manage access to Log Analytics workspaces.", "content_markdown": "## Source facts\n\nMicrosoft lists adding VM extensions among the operations included in Log Analytics Contributor. The same guidance warns that permission to add an extension can be used to gain full control of a VM. The role therefore requires review beyond a requester’s need to read monitoring data. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/manage-access).\n\n## Applicability\n\nUse this review when a team requests Log Analytics Contributor for a person or automation identity. Identify the requested monitoring tasks, proposed assignment scope and machines within that scope. Assess effective inherited permissions as well as the proposed new grant.\n\n## DSE recommendation\n\nDSE recommends asking the monitoring and VM owners to review the requested tasks together. Separate read-only investigation from tasks that change machine configuration. Select a role and scope that fit the approved work, and document any accepted extension-management authority explicitly. Avoid approving a broad role merely because its name sounds limited to analytics.\n\n## Verification\n\nInspect the resulting effective permissions at the intended scope. Use permitted read operations to confirm the monitoring workflow and review whether extension-write authority is present where expected. Do not install an extension on a production machine merely to demonstrate the risk. Retain the permission analysis, assignment identifiers and owner decision for subsequent access reviews.\n\n## Official references\n\n[Microsoft Learn: Manage access to Log Analytics workspaces](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/manage-access)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-105-review-vm-extension-authority-before-granting-log-analytics-contributor/", "url": "https://update.dsesecurity.com/updates/dse-20260917-105-review-vm-extension-authority-before-granting-log-analytics-contributor/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-105-review-vm-extension-authority-before-granting-log-analytics-contributor/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Review VM-extension authority before granting Log Analytics Contributor", "item": "https://update.dsesecurity.com/updates/dse-20260917-105-review-vm-extension-authority-before-granting-log-analytics-contributor/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-105-review-vm-extension-authority-before-granting-log-analytics-contributor/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-105-review-vm-extension-authority-before-granting-log-analytics-contributor/", "url": "https://update.dsesecurity.com/updates/dse-20260917-105-review-vm-extension-authority-before-granting-log-analytics-contributor/", "headline": "Review VM-extension authority before granting Log Analytics Contributor", "description": "A monitoring-role assignment can include operational control beyond reading logs.", "abstract": "A monitoring-role assignment can include operational control beyond reading logs.", "articleBody": "Source facts\nMicrosoft lists adding VM extensions among the operations included in Log Analytics Contributor. The same guidance warns that permission to add an extension can be used to gain full control of a VM. The role therefore requires review beyond a requester’s need to read monitoring data. Microsoft Learn.\nApplicability\nUse this review when a team requests Log Analytics Contributor for a person or automation identity. Identify the requested monitoring tasks, proposed assignment scope and machines within that scope. Assess effective inherited permissions as well as the proposed new grant.\nDSE recommendation\nDSE recommends asking the monitoring and VM owners to review the requested tasks together. Separate read-only investigation from tasks that change machine configuration. Select a role and scope that fit the approved work, and document any accepted extension-management authority explicitly. Avoid approving a broad role merely because its name sounds limited to analytics.\nVerification\nInspect the resulting effective permissions at the intended scope. Use permitted read operations to confirm the monitoring workflow and review whether extension-write authority is present where expected. Do not install an extension on a production machine merely to demonstrate the risk. Retain the permission analysis, assignment identifiers and owner decision for subsequent access reviews.\nOfficial references\nMicrosoft Learn: Manage access to Log Analytics workspaces.", "datePublished": "2026-09-17T16:33:15+00:00", "dateModified": "2026-09-17T16:42:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-105-review-vm-extension-authority-before-granting-log-analytics-contributor/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-105-review-vm-extension-authority-before-granting-log-analytics-contributor/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Review VM-extension authority before granting Log Analytics Contributor" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 211, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Manage access to Log Analytics workspaces - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/manage-access" } } ] } }