services / Azure / Storage account

An Azure Storage account is a primary production data store holding blobs, files, queues, and tables, with control-plane configuration for networking, encryption, access keys, and custom domains.

Storage accounts back a single organizational function's data; their access keys and SAS tokens are full-control data-plane credentials, making key/SAS-returning operations effectively account-takeover primitives.

Microsoft.​Storage/​storageAccounts/​regenerateKey/​action

Regenerates an account access key, invalidating the prior key (denying legitimate clients and disrupting dependents) while returning the freshly generated full-access credential to the caller.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Denial-of-service (HIGH)
3. Lateral movement (BOOST)
4. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links