services / Azure / Key Vault certificate

An Azure Key Vault certificate is a managed X.509 certificate object that bundles a private key, the certificate (public) material, and an issuance/lifecycle policy. It is a credential used by applications and services for TLS, signing, and authentication.

Certificates contain private key material; compromise enables impersonation/MITM of dependent services. Vaults are CRITICAL-sensitivity assets per the scope guide.

Microsoft.​KeyVault/​Vaults/​certificates/​backup/​action

Produces a portable backup blob containing the certificate and its private key that can be restored into another vault in the same subscription, exporting cryptographic credential material.

Risks

1. Cryptographic exfiltration (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links