services / Azure / Network Manager

Azure Virtual Network Manager is a centralized governance layer that authors and pushes connectivity configurations and security-admin rules across many VNets at once within a defined network group scope.

A single manager governs connectivity and security-admin rules across many VNets simultaneously; security-admin rules override per-VNet NSGs, so control of the manager is an org-wide policy/segmentation blast-radius multiplier, warranting CRITICAL.

Microsoft.​Network/​networkManagers/​delete

Deleting a manager tears down the centralized connectivity/security-admin governance across all managed VNets, removing org-wide security policy and disrupting the connectivity it maintained.

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-service (HIGH)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links