services / Azure / Azure SQL Managed Instance

Azure SQL Managed Instance is a fully managed PaaS SQL Server engine hosting production relational databases and the organizational data they contain.

A production data store supporting a single organizational function; its configuration governs data availability, encryption, identity, and network access.

Microsoft.​Sql/​managedInstances/​crossSubscriptionPITR/​action

Authorizing cross-subscription point-in-time restore lets an attacker restore the instance's databases (and their data) into an attacker-controlled subscription, exfiltrating production data across the subscription boundary.

Risks

1. Data exfiltration (CRITICAL)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links