services / Azure / Site Recovery replication protected item

A Site Recovery protected item is an individual workload (typically a VM) that is actively replicated to a recovery region, along with its recovery points, target network, and target resource-group configuration.

Protected items are the actual replicated copies of production workloads and their recovery points; removing or reconfiguring them destroys or misdirects the disaster-recovery copy that gates an organization's ability to recover.

Microsoft.​RecoveryServices/​Vaults/​replicationFabrics/​replicationProtectionContainers/​replicationProtectedItems/​delete

Deleting a protected item destroys its replication and recovery points, removing the disaster-recovery copy for that workload; a classic precursor to a destructive/ransomware attack.

Risks

1. Denial-of-service (HIGH)
2. Infrastructure destruction (HIGH)
3. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links