{"id":"azure-monitor-observability-depends-on-identity-chain","text":"Azure Monitor's compound risk surface is coupled to the identity system: Sentinel and Defender (sharing Log Analytics workspaces) consume identity events generated by Entra, while workspace access itself is governed by the same RBAC model that the Entra identity-to-authorization chain provides — monitoring integrity depends on identity integrity.","truth_value":"IN","source":"","source_url":"","source_hash":"","justifications":[],"dependents":[],"metadata":{},"explanation":{"steps":[{"node":"azure-monitor-observability-depends-on-identity-chain","truth_value":"IN","reason":"premise"}]}}