services / Azure / Virtual Machines

An Azure virtual machine: a production compute resource running an OS, applications, attached disks, network interfaces, and optionally a managed identity.

A VM typically supports a single organizational function; control-plane and data-plane access to it can expose on-disk data, attached managed-identity credentials, and the hosted service's availability.

Microsoft.​Compute/​virtualMachines/​loginAsAdmin/​action

This data action grants Windows administrator/Linux root login to the VM, giving full in-guest control to harvest the managed-identity token, read all local data, tamper with the system, and hijack the host for workloads.

Risks

1. Data exfiltration (CRITICAL)
2. Data manipulation (HIGH)
3. Lateral movement (BOOST)
4. Resource hijacking (MEDIUM)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links