services / Azure / Recovery Services vault

An Azure Recovery Services vault is the control-plane resource that stores and manages backups and recovery points for VMs, databases, files, and other workloads, serving as the organization's disaster-recovery and ransomware-resilience backstop.

The vault itself guards organization-wide recovery data; control-plane reads expose only configuration metadata, while delete/security-PIN operations are far more sensitive.

Microsoft.​RecoveryServices/​Vaults/​backupSecurityPIN/​action

Returns the vault Security PIN, the credential required to authorize critical/destructive backup operations (stop protection with delete data, shorten retention, disable soft-delete), so obtaining it exfiltrates credential material and defeats the vault's last-line defense control.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links