# Review VM-extension authority before granting Log Analytics Contributor

> A monitoring-role assignment can include operational control beyond reading logs.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-105-review-vm-extension-authority-before-granting-log-analytics-contributor/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:15+00:00
- Modified: 2026-09-17T16:42:35+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

A monitoring-role assignment can include operational control beyond reading logs.

## Potentially affected

Use this review when a team requests Log Analytics Contributor for a person or automation identity. Identify the requested monitoring tasks, proposed assignment scope and machines within that scope. Assess effective inherited permissions as well as the proposed new grant.

## DSE recommendation

DSE recommends asking the monitoring and VM owners to review the requested tasks together.

## Article

## Source facts

Microsoft lists adding VM extensions among the operations included in Log Analytics Contributor. The same guidance warns that permission to add an extension can be used to gain full control of a VM. The role therefore requires review beyond a requester’s need to read monitoring data. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/manage-access).

## Applicability

Use this review when a team requests Log Analytics Contributor for a person or automation identity. Identify the requested monitoring tasks, proposed assignment scope and machines within that scope. Assess effective inherited permissions as well as the proposed new grant.

## DSE recommendation

DSE recommends asking the monitoring and VM owners to review the requested tasks together. Separate read-only investigation from tasks that change machine configuration. Select a role and scope that fit the approved work, and document any accepted extension-management authority explicitly. Avoid approving a broad role merely because its name sounds limited to analytics.

## Verification

Inspect the resulting effective permissions at the intended scope. Use permitted read operations to confirm the monitoring workflow and review whether extension-write authority is present where expected. Do not install an extension on a production machine merely to demonstrate the risk. Retain the permission analysis, assignment identifiers and owner decision for subsequent access reviews.

## Official references

[Microsoft Learn: Manage access to Log Analytics workspaces](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/manage-access).

## Primary reference

- Name: Manage access to Log Analytics workspaces - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/manage-access
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Review VM-extension authority before granting Log Analytics Contributor,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-105-review-vm-extension-authority-before-granting-log-analytics-contributor/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.