services / Azure / Recovery Services vault extended information

The vault extended-information object (vaultExtendedInfo) holding the vault's cryptographic registration material: integrityKey, encryptionKey, encryptionKeyThumbprint, and algorithm used in MARS agent registration and backup integrity.

Holds cryptographic key material tied to vault/agent registration; an asset of CRITICAL inherent sensitivity (keys/secrets).

Microsoft.​RecoveryServices/​Vaults/​extendedInformation/​delete

Deleting the extended-info object removes the vault's stored integrity/encryption key material, destroying cryptographic material and impairing backup agent registration and restore operations.

Risks

1. Cryptographic destruction (CRITICAL)
2. Denial-of-service (HIGH)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links