services / Azure / Remove Site Recovery protected item

Disables replication for a protected item and removes it from Site Recovery protection.

Removing a protected item stops its replication and discards its recovery points, eliminating the DR copy for that workload.

Microsoft.​RecoveryServices/​Vaults/​replicationFabrics/​replicationProtectionContainers/​replicationProtectedItems/​remove/​action

Disables replication and removes the item's recovery points, leaving the workload with no disaster-recovery copy; a ransomware precursor.

Risks

1. Infrastructure destruction (HIGH)
2. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links