services / Azure / Application security group

An Application Security Group (ASG) is a logical grouping of network interfaces (by application role) that can be referenced as the source/destination of NSG rules, instead of explicit IP ranges, to scope firewall rules to a set of VMs.

An ASG is a perimeter/segmentation control referenced by NSG rules; membership in one determines which firewall rules apply to a given interface, so misuse indirectly controls network access the same way an NSG does. Rated consistent with the other network-segmentation resources documented alongside it.

Microsoft.​Network/​applicationSecurityGroups/​listIpConfigurations/​action

Lists the IP configurations (interfaces/VMs) that are members of the ASG, revealing which hosts belong to a given application tier and are therefore in scope for any NSG rule that references this group; useful for mapping which hosts to target to inherit or evade that rule's access.

Risks

1. Network discovery (LOW)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links