services / Azure / User Assigned Identities

Azure user-assigned managed identities: standalone identity principals (with clientId/principalId) that can be granted RBAC roles and attached to compute resources to authenticate as that identity.

Managed identities are first-class security principals; controlling or attaching them is a direct path to lateral movement and privilege escalation.

Microsoft.​ManagedIdentity/​userAssignedIdentities/​delete

Deleting a user-assigned identity destroys an identity principal and breaks authentication for every resource bound to it, denying service to dependent workloads.

Risks

1. Account destruction (CRITICAL)
2. Denial-of-service (HIGH)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links