services / Azure / Private DNS A record set

An A record set maps internal hostnames to IPv4 addresses within an Azure Private DNS zone, used for name resolution inside linked virtual networks.

Private (internal) records, not public-facing; supports a single organizational network function.

Microsoft.​Network/​privateDnsZones/​A/​write

Creating/updating the record set replaces internal hostname-to-IP mappings, letting an attacker repoint internal names to attacker-controlled IPs to route/intercept traffic (DNS hijack within the private zone).

Risks

1. Domain takeover (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links