services / Azure / IP Group

An IP Group is a reusable named set of IP addresses/ranges referenced by Azure Firewall and NSG rules, letting many rules share a single maintained address list.

An IP Group is referenced by firewall/NSG rules; changing its ranges silently reshapes every rule that references it, making it a policy-bearing object.

Microsoft.​Network/​ipGroups/​write

Creating/updating an IP Group rewrites the address ranges that referencing firewall/NSG rules enforce; an attacker can silently widen an allow-list (e.g. add attacker IPs) across every rule that consumes the group, weakening the effective policy.

Risks

1. Policy destruction (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links