services / Azure / Azure SQL Server

An Azure SQL logical server that hosts one or more production SQL databases and governs their admin login, identity, networking, and encryption configuration.

A primary production data store; control over the server confers broad control over hosted databases and their data.

Microsoft.​Sql/​servers/​write

Create/update can reset the administrator login/password, assign a managed identity to the server (lateral movement), and alter security-relevant configuration, granting persistent privileged access to the production database server.

Risks

1. Data manipulation (HIGH)
2. Account persistence (BOOST)
3. Lateral movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links