services / Azure / ExpressRoute circuit authorizations

An ExpressRoute circuit authorization is a grant (with an associated authorization key) that permits a virtual network gateway to link into a private ExpressRoute circuit, providing hybrid/private connectivity between Azure and on-premises or other networks.

Authorization keys are connection credentials: holding one lets a party peer their own gateway onto the private circuit, so they are sensitive credential material for a single production network function.

Microsoft.​Network/​expressRouteCircuits/​authorizations/​delete

Deleting an authorization removes the connectivity grant, severing legitimate gateway connections that depend on it and disrupting the private/hybrid link.

Risks

1. Denial-of-service (HIGH)
2. Network destruction (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links