services / Azure / ExpressRoute circuit

An ExpressRoute circuit is a dedicated private connectivity resource linking on-premises networks to Azure through a connectivity provider, bypassing the public internet.

Production hybrid-connectivity infrastructure supporting a single organizational function's network reach; its authorization keys are connectivity credentials.

Microsoft.​Network/​expressRouteCircuits/​listAuthorizations/​action

Returns the circuit authorization keys (credential material) that let an external party peer their own VNet/gateway onto the circuit, enabling credential exfiltration and unauthorized network movement onto the connected network.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links