services / Azure / Managed disks

An Azure managed disk is the block-storage volume backing a virtual machine's OS or data partition; it holds the full filesystem contents of the VM including any OS credentials, application data, and secrets stored on disk.

A managed disk holds the persistent data of a single compute workload. SAS-based access to its raw bytes bypasses VM-level access controls and OS authentication.

Microsoft.​Compute/​disks/​beginGetAccess/​action

Mints a SAS URI (a SAS token, cryptographic credential material) granting direct out-of-band blob-level read of the entire raw disk image, enabling bulk exfiltration of all data on the volume outside Azure RBAC.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Data exfiltration (CRITICAL)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links