services / Azure / API Management tenant access keys

The API Management tenant access keys (primary/secondary) authenticate direct access to the service's legacy Management REST endpoint and the Git configuration repository, which control the entire APIM service configuration (APIs, policies, named values).

These keys grant broad management-plane access to a single APIM service instance; possession is equivalent to administrative control of the gateway. The /read action exposes the listSecrets path, which returns the live key values.

Microsoft.​ApiManagement/​service/​Tenants/​keys/​regenerateSecondaryKey/​action

Regenerating the secondary key invalidates the existing secondary credential (denying clients relying on it) and mints a new attacker-controllable value for persistent management access. The REST operation returns 204 No Content and does not disclose the new key.

Risks

1. Account persistence (BOOST)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links