services / Azure / API Management tenant access keys

The API Management tenant access keys (primary/secondary) authenticate direct access to the service's legacy Management REST endpoint and the Git configuration repository, which control the entire APIM service configuration (APIs, policies, named values).

These keys grant broad management-plane access to a single APIM service instance; possession is equivalent to administrative control of the gateway. The /read action exposes the listSecrets path, which returns the live key values.

Microsoft.​ApiManagement/​service/​Tenants/​keys/​write

Create/update/renew lets an attacker set or rotate the tenant access key to a value they control, planting durable management-plane credentials and altering the service's authentication configuration.

Risks

1. Data manipulation (HIGH)
2. Account persistence (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links