services / Azure / Virtual network gateway connection

A VirtualNetworkGatewayConnection links a virtual network gateway to a peer (another gateway, a local network gateway for site-to-site VPN, or an ExpressRoute circuit), establishing cross-premises or cross-network IPsec/ExpressRoute connectivity.

These connections bridge Azure VNets with on-premises or partner networks; compromise can expose the IPsec pre-shared key, intercept tunnel traffic, or sever connectivity for dependent workloads.

Microsoft.​Network/​connections/​vpndeviceconfigurationscript/​action

Generates the VPN device configuration script, which embeds the connection's pre-shared key and tunnel/topology parameters, exposing credential material and detailed network configuration.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Network discovery (LOW)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links