services / Azure / Security Partner Provider

A Security Partner Provider routes traffic through a third-party security service (e.g. a cloud-delivered firewall) for inspection before it reaches its destination.

Sits in the traffic path as a security-inspection hop; removing or rerouting it disables inspection or diverts traffic away from the intended security service.

Microsoft.​Network/​securityPartnerProviders/​write

Creating/updating the provider lets an attacker reroute the security-inspection path to an attacker-chosen service or reconfigure it, bypassing or disabling third-party inspection of the traffic.

Risks

1. Data manipulation (HIGH)
2. Network movement (BOOST)
3. Defense destruction (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links