services / Azure / Managed disks

An Azure managed disk is the block-storage volume backing a virtual machine's OS or data partition; it holds the full filesystem contents of the VM including any OS credentials, application data, and secrets stored on disk.

A managed disk holds the persistent data of a single compute workload. SAS-based access to its raw bytes bypasses VM-level access controls and OS authentication.

Microsoft.​Compute/​disks/​download/​action

Data-plane read over the disk SAS URI streams the full raw disk contents (OS/data volume), directly exfiltrating all organizational data it holds.

Risks

1. Data exfiltration (CRITICAL)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links