services / Azure / Site Recovery recovery plan unplanned failover

Triggers an unplanned failover of all protected items in a recovery plan to their recovery region, without a graceful source shutdown.

An unplanned failover of a recovery plan forcibly relocates every workload in the plan to the recovery site at once, a broad disruption that also moves the workloads into their configured recovery networks.

Microsoft.​RecoveryServices/​Vaults/​replicationRecoveryPlans/​unplannedFailover/​action

Forces every workload in the plan over to the recovery region, causing broad service disruption and relocating them into the configured recovery networks the attacker may control.

Risks

1. Denial-of-service (HIGH)
2. Network movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links