MicrosoftMicrosoftBeware of a bug with Defender for Containers! If you are using a centralized Log Analytics Workspace (LAW), in the case of a CAF/Landing Zone environment, end-users will not be able to update the AKS's Authorized IP Ranges without having Contributor access to the LAW!
This is, obviously, not ideal. Especially when the centralized LAW is used with Sentinel and contains security data from the entire platform and other Landing Zone environments.
The challenge, is that for companies that adopt the Cloud Adoption Framework (CAF), Microsoft "recommends" (and in the case of the Terraform module for CAF), enforces, a centralized LAW for monitoring and security data.
MicrosoftHi AdinErmie,
From what you described, while the Defender for Containers sensor uses Log Analytics Workspace under the hood, this doesn’t seem like a specific issue to Defender for Containers sensor. It sounds like a permission check happening in the AKS control plane when the cluster is configured to use a Log Analytics Workspace. I recommend opening a support case to investigate this setup further.
FYI, this has been reported, and the Product Group has confirmed it's a bug.
