services / Azure / DNS Alias of a Public IP Address

A DNS alias of a public IP address binds a publicly resolvable DNS name/FQDN to an Azure public IP, controlling how that name routes to the endpoint.

Controls public-facing DNS routing; write/delete enable domain/subdomain takeover and defacement of public-facing assets.

Microsoft.​Network/​publicIPAddresses/​dnsAliases/​write

Creating/updating a DNS alias binds a chosen public DNS name to an IP, letting an attacker redirect traffic for that domain/subdomain to controlled infrastructure and alter the org's public-facing endpoint.

Risks

1. Domain takeover (CRITICAL)
2. Defacement (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links