services / Azure / Recovery Services backup recovery points (location)

Location-scoped Recovery Services backup operations that operate on a vault's protected backup recovery points and cross-region restore workflow in the secondary (paired) region.

Backup recovery points contain copies of protected organizational data (VM disks, files, databases); the cross-region restore surface can surface that data into a secondary region.

Microsoft.​RecoveryServices/​Locations/​backupCrossRegionRestore/​action

Triggering a cross-region restore reconstitutes protected backup data into a secondary-region target the attacker can influence, exfiltrating organizational data and provisioning billable restore infrastructure.

Risks

1. Data exfiltration (CRITICAL)
2. Spend (MEDIUM)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links