services / Azure / Azure SQL Managed Instance administrator

The Azure AD/Entra administrator binding for an Azure SQL Managed Instance, designating the privileged principal that holds full administrative control over the instance and all databases it hosts.

This is the top-level identity/access-control assignment for a production database instance; controlling it confers admin over all instance data.

Microsoft.​Sql/​managedInstances/​administrators/​write

Creates or updates the AAD administrator, letting an attacker designate an attacker-controlled principal as full instance admin (escalation:privilege), gaining admin over all instance data (escalation:lateral) and establishing durable privileged access (persistence:account); also overwrites the legitimate admin.

Risks

1. Privilege escalation (CRITICAL)
2. Account persistence (BOOST)
3. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links