services / Azure / APIM group users

The membership association between API Management developer-portal groups and user accounts; groups gate visibility of and access to API products.

Group membership governs which products/APIs a developer-portal account can see and subscribe to, so it functions as an access-control grouping within the APIM instance.

Microsoft.​ApiManagement/​service/​groups/​users/​write

Adding a controlled user to a group grants that account the product/API access tied to the group, escalating its effective privileges in the developer portal.

Risks

1. Privilege escalation (CRITICAL)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links