services / Azure / Network Manager

Azure Virtual Network Manager is a centralized governance layer that authors and pushes connectivity configurations and security-admin rules across many VNets at once within a defined network group scope.

A single manager governs connectivity and security-admin rules across many VNets simultaneously; security-admin rules override per-VNet NSGs, so control of the manager is an org-wide policy/segmentation blast-radius multiplier, warranting CRITICAL.

Microsoft.​Network/​networkManagers/​commit/​action

Commit deploys the staged connectivity/security-admin configuration across the managed VNet scope, actually taking effect; an attacker can punch connectivity between many VNets (lateral movement) or override per-VNet NSG rules org-wide in a single operation.

Risks

1. Policy destruction (CRITICAL)
2. Data manipulation (HIGH)
3. Network movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links