services / Azure / API Management user accounts

A developer-portal user account record in an Azure API Management (APIM) service instance.

User accounts can be used to obtain/manage subscriptions and subscription keys for APIs published through the APIM instance.

Microsoft.​ApiManagement/​service/​users/​action

Registering a new developer-portal user creates an attacker-controlled account that can maintain access to the API surface and obtain subscription keys for protected APIs.

Risks

1. Account persistence (BOOST)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links