services / Azure / Site Recovery protection cluster test failover

Performs an isolated test failover of a protection cluster, instantiating a running copy of the clustered workload into a test network without affecting production.

A test failover spins up a full running copy of the clustered workload and its data; when directed into an attacker-influenced test network it yields offline access to that data outside production controls.

Microsoft.​RecoveryServices/​Vaults/​replicationFabrics/​replicationProtectionContainers/​replicationProtectionClusters/​testFailover/​action

Instantiates a live copy of the clustered workload in a chosen test network, letting an attacker access its data and reach it from network positions they control.

Risks

1. Data exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links