services / Azure / Recovery Services vault extended information

The vault extended-information object (vaultExtendedInfo) holding the vault's cryptographic registration material: integrityKey, encryptionKey, encryptionKeyThumbprint, and algorithm used in MARS agent registration and backup integrity.

Holds cryptographic key material tied to vault/agent registration; an asset of CRITICAL inherent sensitivity (keys/secrets).

Microsoft.​RecoveryServices/​Vaults/​extendedInformation/​write

PUT/PATCH overwrites the vault's integrityKey/algorithm registration material, tampering with the vault's cryptographic/registration configuration backing backup integrity.

Risks

1. Data manipulation (HIGH)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links