services / Azure / API Management service

An Azure API Management (APIM) service instance is a managed API gateway that fronts, secures, and routes traffic to a business function's backend APIs, holding gateway policies, named-value secrets, certificates, custom domains, and developer/subscription identities.

The gateway sits on the public-facing path of an organizational function's APIs and can hold credential material (named values, certificates, subscription keys) and a managed identity; treat it as a single-function production service of HIGH sensitivity.

Microsoft.​ApiManagement/​service/​updatehostname/​action

Setting/updating/removing custom domain names rebinds which domain routes to the gateway, enabling domain takeover and alteration of the public-facing API endpoint.

Risks

1. Domain takeover (CRITICAL)
2. Defacement (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links