Review VM-extension authority before granting Log Analytics Contributor

Source facts

Microsoft lists adding VM extensions among the operations included in Log Analytics Contributor. The same guidance warns that permission to add an extension can be used to gain full control of a VM. The role therefore requires review beyond a requester’s need to read monitoring data. Microsoft Learn.

Applicability

Use this review when a team requests Log Analytics Contributor for a person or automation identity. Identify the requested monitoring tasks, proposed assignment scope and machines within that scope. Assess effective inherited permissions as well as the proposed new grant.

DSE recommendation

DSE recommends asking the monitoring and VM owners to review the requested tasks together. Separate read-only investigation from tasks that change machine configuration. Select a role and scope that fit the approved work, and document any accepted extension-management authority explicitly. Avoid approving a broad role merely because its name sounds limited to analytics.

Verification

Inspect the resulting effective permissions at the intended scope. Use permitted read operations to confirm the monitoring workflow and review whether extension-write authority is present where expected. Do not install an extension on a production machine merely to demonstrate the risk. Retain the permission analysis, assignment identifiers and owner decision for subsequent access reviews.

Official references

Microsoft Learn: Manage access to Log Analytics workspaces.