services / Azure / Site Recovery replication protected item

A Site Recovery protected item is an individual workload (typically a VM) that is actively replicated to a recovery region, along with its recovery points, target network, and target resource-group configuration.

Protected items are the actual replicated copies of production workloads and their recovery points; removing or reconfiguring them destroys or misdirects the disaster-recovery copy that gates an organization's ability to recover.

Microsoft.​RecoveryServices/​Vaults/​replicationFabrics/​replicationProtectionContainers/​replicationProtectedItems/​write

Updating a protected item can redirect its recovery target network/resource group or shrink recovery-point retention, redirecting where the DR copy lands and reducing the recoverable history available after an attack.

Risks

1. Data manipulation (HIGH)
2. Network movement (BOOST)
3. Defense destruction (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links