Question: Is there any way to tell Defender for Containers component to use GET instead of POST request to fetch Log Analytics shared keys?

Background:
Due to security guard rails that our organization needs to comply with, our platform team applied a read-only lock on the central log analytics workspace. A security team also enabled Defender for Containers to be pushed out, which affected an Azure Kubernetes Cluster within our landing zone.

Problem:
The Defender for Containers component appears to have been trying to POST to the log analytics (ARM) API to fetch shared keys. This POST failed due to the read-only lock on the central log analytics workspace. After this, the AKS cluster could not be modified; any attempt to do so triggered the defender for containers component to attempt the POST again , which fails and blocks the cluster write/update operation from succeeding.

Work-arounds:
The workarounds we found so far were:
* Temporarly remove the read-only lock from the central log analytics workspace, then reconfigure the Defender for Containers component to use some other log analytics workspace where there is no read-only lock, then re-apply the read-only lock on the log analytics workspace; or,
* Temporarily remove the read-only lock on the central log analytics workspace, before any change is made to the AKS cluster and reapply it afterward. Not a very sustainable approach if done manually. Could be automated in our devops pipeline potentially.

Questions:
Is there any way to configure the Defender for Containers component to use a GET instead when fetching the shared keys?

I'm just wondering if anyone else has run into this and if there is some other way of working around the issue that we haven't yet considered.

Thanks!

The issue names no repository files, tests, or entry points. Start by reviewing the Defender for Containers and Log Analytics configuration involved in the AKS update, then verify the ARM request behavior with the read-only workspace lock. Done means establishing whether request method configuration is supported and documenting a confirmed alternative if it is not.

Written by the indexing model from the issue text.