services / Azure / Key Vault certificate

An Azure Key Vault certificate is a managed X.509 certificate object that bundles a private key, the certificate (public) material, and an issuance/lifecycle policy. It is a credential used by applications and services for TLS, signing, and authentication.

Certificates contain private key material; compromise enables impersonation/MITM of dependent services. Vaults are CRITICAL-sensitivity assets per the scope guide.

Microsoft.​KeyVault/​Vaults/​certificates/​update/​action

Updates attributes (such as enabled state or policy) of an existing certificate without changing its key material, letting an attacker re-enable a disabled certificate or alter its issuance/renewal policy.

Risks

1. Data manipulation (HIGH)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links