services / Azure / Web App slot domain ownership identifiers

Custom-domain ownership-verification identifiers (tokens) used to prove and bind a custom domain to a Web App deployment slot.

Controls custom-domain verification/binding for the public-facing app; write/delete can affect domain routing.

Microsoft.​Web/​Sites/​slots/​domainownershipidentifiers/​write

Creating/updating domain-ownership identifiers manipulates the custom-domain verification/binding state, which can be abused to assert ownership and route a domain to the app.

Risks

1. Domain takeover (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links