services / Azure / User Assigned Identities

Azure user-assigned managed identities: standalone identity principals (with clientId/principalId) that can be granted RBAC roles and attached to compute resources to authenticate as that identity.

Managed identities are first-class security principals; controlling or attaching them is a direct path to lateral movement and privilege escalation.

Microsoft.​ManagedIdentity/​userAssignedIdentities/​write

Creating a new user-assigned identity establishes an attacker-controlled principal that can later be granted roles and attached to resources, a durable persistence foothold; updating an existing one only changes tags.

Risks

1. Account persistence (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links