services / Azure / Web App

An Azure App Service site (Web App, Function App, or Logic App Standard) is a managed hosting resource that runs an organization's application code, often with an attached managed identity, app settings/connection strings, and a public-facing endpoint.

Production application hosting for a single organizational function; can hold secrets in app settings, run code under a managed identity, and serve public traffic.

Microsoft.​Web/​Sites/​backup/​Action

Triggering a backup writes a copy of the app's content, configuration, and linked database to a caller-specified storage target, enabling exfiltration of app data and incurring storage cost.

Risks

1. Data exfiltration (CRITICAL)
2. Spend (MEDIUM)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links