services / Azure / Azure SQL Managed Instance hybrid link

A hybrid link (Managed Instance link) is a distributed availability group that replicates databases between an external/on-premises SQL Server and an Azure SQL Managed Instance.

Operates on a production database service; the link governs cross-environment replication of database contents.

Microsoft.​Sql/​managedInstances/​hybridLink/​write

Creating/updating the hybrid link establishes a distributed availability group that continuously replicates production database data to an external (potentially attacker-controlled) SQL Server, enabling data exfiltration, alteration of replication configuration, and extension of reach to additional networked resources.

Risks

1. Data exfiltration (CRITICAL)
2. Data manipulation (HIGH)
3. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links