services / Azure / Azure SQL Database server DNS alias

A SQL server DNS alias is a stable CNAME-like DNS name that maps clients to an Azure SQL logical server, allowing the underlying server to change without updating connection strings.

Controlling an alias controls the connection endpoint clients resolve to reach production databases; it is effectively a routing/domain control for the database service.

Microsoft.​Sql/​servers/​dnsAliases/​delete

Deleting a DNS alias removes the stable connection name clients resolve to, breaking application connectivity to the database (denial of service).

Risks

1. Denial-of-service (HIGH)
2. Network destruction (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links