services / Azure / Network Watcher connectivity check

Verifies whether a direct TCP connection can be established from a source VM to a given destination (another VM or an arbitrary remote endpoint), reporting reachability, latency, and hop-by-hop path.

Read-only, and functionally covers the same recon value as ipFlowVerify (allow/deny check for a specific flow) and nextHop (routing path for a destination), which are not separately documented here as they test the same reachability question from different angles.

Microsoft.​Network/​networkWatchers/​connectivityCheck/​action

Lets an attacker use a compromised VM's network position to test reachability to internal or external targets, using Azure's own tooling as a network scanner/pivot-mapping primitive instead of installing scanning tools that might trigger endpoint detection.

Risks

1. Network discovery (LOW)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links