services / Azure / User Assigned Identities

Azure user-assigned managed identities: standalone identity principals (with clientId/principalId) that can be granted RBAC roles and attached to compute resources to authenticate as that identity.

Managed identities are first-class security principals; controlling or attaching them is a direct path to lateral movement and privilege escalation.

Microsoft.​ManagedIdentity/​userAssignedIdentities/​assign/​action

Assigning an existing user-assigned identity to a resource lets an attacker attach a potentially more-privileged identity to compute they control and act as it, the canonical Azure lateral-movement and privilege-escalation primitive.

Risks

1. Privilege escalation (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links