services / Azure / Recovery Services vault extended information

The vault extended-information object (vaultExtendedInfo) holding the vault's cryptographic registration material: integrityKey, encryptionKey, encryptionKeyThumbprint, and algorithm used in MARS agent registration and backup integrity.

Holds cryptographic key material tied to vault/agent registration; an asset of CRITICAL inherent sensitivity (keys/secrets).

Microsoft.​RecoveryServices/​Vaults/​extendedInformation/​read

GET returns the vault's integrityKey (and the schema includes encryptionKey/encryptionKeyThumbprint) as base64 material; verified the sample response literally returns integrityKey, so this discloses cryptographic key material rather than mere config.

Risks

1. Cryptographic exfiltration (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links