services / Azure / Azure SQL Managed Instance administrator

The Azure AD/Entra administrator binding for an Azure SQL Managed Instance, designating the privileged principal that holds full administrative control over the instance and all databases it hosts.

This is the top-level identity/access-control assignment for a production database instance; controlling it confers admin over all instance data.

Microsoft.​Sql/​managedInstances/​administrators/​delete

Deletes the existing administrator binding, removing the access-control assignment (destruction:policy) and revoking the legitimate admin's authorized access to the instance (impact:access).

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links