services / Azure / Network authorization policies

A network authorization policy defines access-control rules governing which principals or resources may connect to, join, or associate with a network resource.

Writing/deleting alters which principals/resources can associate with network resources, making this access-control policy security-relevant.

Microsoft.​Network/​authorizationPolicies/​write

Creating/updating the policy lets an attacker grant additional principals/resources permission to connect, which is both a privilege grant (escalation:privilege) and expansion of reachable network (escalation:network), while manipulating the access-control config (impact:manipulation).

Risks

1. Privilege escalation (CRITICAL)
2. Data manipulation (HIGH)
3. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links