services / Azure / Azure SQL Managed Instance DNS alias

A friendly, CNAME-style DNS name that maps to an Azure SQL Managed Instance endpoint, allowing clients to connect using a stable alias rather than the instance's native hostname.

Controlling an alias controls where client connection traffic for a database endpoint resolves; aliases can be transferred (acquired) between instances.

Microsoft.​Sql/​managedInstances/​dnsAliases/​write

Creating/updating a DNS alias controls the name clients use to reach the managed instance, letting an attacker redirect database client connection traffic to an instance they control.

Risks

1. Domain takeover (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links