services / Azure / API Management tenant access keys

The API Management tenant access keys (primary/secondary) authenticate direct access to the service's legacy Management REST endpoint and the Git configuration repository, which control the entire APIM service configuration (APIs, policies, named values).

These keys grant broad management-plane access to a single APIM service instance; possession is equivalent to administrative control of the gateway. The /read action exposes the listSecrets path, which returns the live key values.

Microsoft.​ApiManagement/​service/​Tenants/​keys/​delete

Deleting the tenant access key destroys credential material and revokes the management/Git access path that legitimate operators and automation rely on.

Risks

1. Cryptographic destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links