services / Azure / Azure SQL Managed Instance distributed availability groups

A distributed availability group is a replication link between an Azure SQL Managed Instance and a partner instance (or SQL Server), used for high availability, disaster recovery, and migration.

These links sit in front of production managed-instance databases; controlling them affects data replication direction, availability, and where production data flows.

Microsoft.​Sql/​managedInstances/​distributedAvailabilityGroups/​write

Creating/configuring a distributed availability group establishes a replication link that can continuously stream production database contents to an attacker-influenced partner instance and alters the instance's replication configuration.

Risks

1. Data exfiltration (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links