services / Azure / Network Manager

Azure Virtual Network Manager is a centralized governance layer that authors and pushes connectivity configurations and security-admin rules across many VNets at once within a defined network group scope.

A single manager governs connectivity and security-admin rules across many VNets simultaneously; security-admin rules override per-VNet NSGs, so control of the manager is an org-wide policy/segmentation blast-radius multiplier, warranting CRITICAL.

Microsoft.​Network/​networkManagers/​write

Creating/updating a manager lets an attacker author connectivity and security-admin rule configurations (which override NSGs) across the managed VNet scope; the configuration is staged here and takes effect on commit.

Risks

1. Policy destruction (CRITICAL)
2. Data manipulation (HIGH)
3. Network movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links