services / Azure / API Connection Access Policies

Connection access policies are the access-control entries (objectId/tenantId grants) governing which principals may use an Azure API Connection, which brokers credentialed access to a backend service (e.g. for Logic Apps).

The connection wraps stored/delegated credentials to a backend system; access to use it confers access to that backend.

Microsoft.​Web/​connections/​accessPolicies/​write

Adding/updating an access policy lets an attacker grant an attacker-chosen principal authorization to use the connection (escalation:privilege); because the connection brokers credentialed access to a backend, the granted identity can then reach that backend (escalation:lateral).

Risks

1. Privilege escalation (CRITICAL)
2. Lateral movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links