services / Azure / ExpressRoute LAG authorizations

ExpressRoute LAG authorizations are authorization objects (with associated authorization keys) that permit circuits to cross-connect into a dedicated ExpressRoute LAG.

The authorization key is a credential that lets a circuit link into the private network; the authorization object's read path returns only metadata, not the key.

Microsoft.​Network/​expressRouteLags/​authorizations/​listKeys/​action

This action returns the ExpressRoute AuthorizationKey, credential material an attacker can export and redeem to cross-connect a circuit into the organization's private network.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links