services / Azure / Azure Functions master key

The Azure Functions master key, an administrative credential that grants full control to invoke and manage all functions and the function-app admin/key-management APIs.

This is a root-level runtime credential equivalent to code execution as the function app and its managed identity.

Microsoft.​Web/​Sites/​functions/​masterkey/​read

Returns the master key, reusable credential material enabling arbitrary code execution as the app and lateral movement to its identity.

Risks

1. Cryptographic exfiltration (CRITICAL)
2. Lateral movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links