services / Azure / API Connection Access Policies

Connection access policies are the access-control entries (objectId/tenantId grants) governing which principals may use an Azure API Connection, which brokers credentialed access to a backend service (e.g. for Logic Apps).

The connection wraps stored/delegated credentials to a backend system; access to use it confers access to that backend.

Microsoft.​Web/​connections/​accessPolicies/​Delete

Deleting access policies removes access-control grants on the connection (destruction:policy), stripping legitimate principals (e.g. a Logic App's managed identity) of their authorized access to use the connection (impact:access).

Risks

1. Policy destruction (CRITICAL)
2. Denial-of-access (EVASION)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links