services / Azure / Virtual network gateway

An Azure Virtual Network Gateway provides VPN (site-to-site / point-to-site) and ExpressRoute connectivity between an Azure VNet and on-premises or remote networks. It is the production network ingress/egress edge for hybrid connectivity.

A gateway is the trust boundary for a single VNet's hybrid/remote connectivity; control of it can expose or sever access to an entire private network and its hosted services.

Microsoft.​Network/​virtualNetworkGateways/​geteffectiveroutes/​action

Returns the gateway's effective route table, disclosing the full set of connected subnets and peer network ranges reachable through the gateway. Read-only, but reveals the entire bridged network topology; one of several BGP/route-disclosure actions on this gateway treated with the same risk reasoning.

Risks

1. Network discovery (LOW)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links