services / Azure / Key Vault certificate

An Azure Key Vault certificate is a managed X.509 certificate object that bundles a private key, the certificate (public) material, and an issuance/lifecycle policy. It is a credential used by applications and services for TLS, signing, and authentication.

Certificates contain private key material; compromise enables impersonation/MITM of dependent services. Vaults are CRITICAL-sensitivity assets per the scope guide.

Microsoft.​KeyVault/​Vaults/​certificates/​read

Lists certificates in the vault or gets information about a certificate; returns the public portion and metadata only, not the private key, so exposure is limited to asset inventory and configuration.

Risks

1. Metadata discovery (LOW)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links