services / Azure / Key Vault managed storage account

A Key Vault managed storage account is a vault object that links Key Vault to an Azure Storage account so the vault manages (and auto-regenerates) the storage account's access keys and issues SAS tokens on its behalf. The object holds the storage account resource ID, the active key name, and the auto-regeneration period.

This is a deprecated Key Vault feature that nonetheless mediates storage-account credentials; objects here govern credential issuance for the backing storage account, making the asset credential-management-sensitive (CRITICAL).

Microsoft.​KeyVault/​Vaults/​storageAccounts/​backup/​action

Produces a backup file bundling the managed storage account definition together with its SAS material, exporting credential-bearing data that can be restored or replayed to obtain access to the backing storage account.

Risks

1. Cryptographic exfiltration (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links