services / Azure / Recovery Services backup recovery points

Recovery points (backup snapshots) of protected items managed under a Recovery Services vault's backup fabric, representing point-in-time copies of organizational data.

Recovery points and the restore machinery around them ultimately gate access to backed-up production data; enumeration is reconnaissance while restore is full data access.

Microsoft.​RecoveryServices/​Vaults/​backupFabrics/​restore/​action

Triggers an actual restore of recovery points, which can recover backed-up organizational data to an attacker-chosen target (exfiltration) and overwrite/alter live data in place (manipulation); this is the headline data-access capability of a backup vault.

Risks

1. Data exfiltration (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links