services / Azure / Site Recovery protected item test failover

Performs an isolated test failover of a protected item, instantiating a running copy of the workload from its recovery point into a test network without affecting the production source.

A test failover spins up a full running copy of the production workload and its data; when directed into an attacker-influenced test network it yields offline access to that data outside production controls.

Microsoft.​RecoveryServices/​Vaults/​replicationFabrics/​replicationProtectionContainers/​replicationProtectedItems/​testFailover/​action

Instantiates a live copy of the protected workload in a chosen test network, letting an attacker access the workload's data and reach it from network positions they control.

Risks

1. Data exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links