services / Azure / ExpressRoute Ports authorizations

An ExpressRoute Ports authorization is a grant on a dedicated ExpressRoute port that permits an ExpressRoute circuit to be linked to that port; it carries an authorization key used to redeem the link.

The authorization key is effectively a network-access credential: holding it lets a party attach a circuit and gain access onto the organization's private ExpressRoute connectivity.

Microsoft.​Network/​expressRoutePorts/​authorizations/​listKeys/​action

Returns the authorization key secret, which can be redeemed to connect a circuit to the port, enabling network movement onto the private connectivity.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links