services / Azure / Network Watcher topology

Returns a network-level view of the resources deployed in a resource group and their relationships (VNets, subnets, NICs, NSGs, public IPs, load balancers, and how they connect).

Read-only. Represents the built-in resource-relationship-mapping entry in Network Watcher's recon toolkit; distinct from the securityGroupView/connectivityCheck actions because it operates at the resource-graph level rather than rule- or path-level.

Microsoft.​Network/​networkWatchers/​topology/​action

Gives an attacker a ready-made map of a resource group's network architecture and resource relationships, materially speeding up reconnaissance of an unfamiliar environment compared to enumerating each resource type individually.

Risks

1. Infrastructure discovery (LOW)
2. Network discovery (LOW)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links