services / Azure / Azure SQL Sync Group

An Azure SQL Data Sync group defines a hub-and-member data replication topology that synchronizes table data between a hub database and one or more member databases. It is a control-plane configuration object on a production database.

Sync groups govern the flow of operational data between databases; misconfiguration can redirect, overwrite, or disrupt replication of a single organizational function's data.

Microsoft.​Sql/​servers/​databases/​syncGroups/​write

Creating/updating a sync group defines which databases replicate, the direction, and conflict resolution; an attacker can reshape operational data flow and add a member pointing at a database they influence to siphon synced production data.

Risks

1. Data exfiltration (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links