services / Azure / Container registry export pipelines

Export pipeline resources that configure automated copy of container registry artifacts out to a target storage account (with an associated managed identity and key-vault SAS reference).

Control-plane configuration of the registry's content-export workflow; the pipeline binds a managed identity and points at an external storage target.

Microsoft.​ContainerRegistry/​registries/​exportPipelines/​write

Creates or updates an export pipeline, configuring automated export of registry artifacts (container images containing application code/binaries) to attacker-chosen storage and binding a managed identity to operate the transfer.

Risks

1. Data exfiltration (CRITICAL)
2. Code exfiltration (HIGH)
3. Data manipulation (HIGH)
4. Lateral movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links