services / Azure / API Management groups

API Management groups are authorization constructs that bind users/developers to product and API access; group membership governs which products and APIs a developer can subscribe to and use.

Groups are the access-control grouping layer of the developer-facing surface; manipulating them changes who can access which APIs/products.

Microsoft.​ApiManagement/​service/​groups/​delete

Deletes a group used for product/API authorization, destroying the access-control grouping and revoking legitimate members' access to the products/APIs they relied on.

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links