services / Azure / IP Group

An IP Group is a reusable named set of IP addresses/ranges referenced by Azure Firewall and NSG rules, letting many rules share a single maintained address list.

An IP Group is referenced by firewall/NSG rules; changing its ranges silently reshapes every rule that references it, making it a policy-bearing object.

Microsoft.​Network/​ipGroups/​join/​action

Joining an IP Group lets a principal reference/attach the group into firewall or NSG rules it does not otherwise control, bypassing the segmentation control that gates which address lists a rule may use; flagged Not Alertable.

Risks

1. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links