services / Azure / Azure SQL DB job credential

An Azure SQL DB job credential stores the username and (write-only) password the job agent uses to authenticate to target databases when running elastic jobs.

The control-plane read does not return the secret password (it is write-only), so reads only expose the identity/username rather than usable secret material.

Microsoft.​Sql/​servers/​jobAgents/​credentials/​write

Creating/updating a job credential lets an attacker plant an attacker-chosen username/password that jobs use to authenticate to target databases, establishing reusable controlled credentials and lateral access.

Risks

1. Account persistence (BOOST)
2. Lateral movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links