services / Azure / APIM product subscriptions

APIM product subscriptions, which bind a user/principal to a product and carry the primary/secondary subscription keys used to authenticate calls to the product's APIs through the gateway.

Subscription keys are bearer credentials granting authorized access to backend APIs; the subscription entity itself (without keys) is access-grant configuration.

Microsoft.​ApiManagement/​service/​subscriptions/​delete

Deleting a subscription immediately revokes the associated keys, cutting off legitimate consumers' authorized access to the product's APIs and disrupting dependent integrations.

Risks

1. Denial-of-service (HIGH)
2. Denial-of-access (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links