services / Azure / API Connections

Azure API Connections (Microsoft.Web/connections) are integration resources that store credential-backed connections (OAuth tokens, API keys, connection strings) used by Logic Apps and Power Automate to authenticate to backend SaaS and API services.

These resources broker authenticated access to external/backend systems and hold stored credential material, so key-listing and invoke operations are credential-grade exposures even though most control-plane operations affect a single integration function.

Microsoft.​Web/​connections/​write

Create/update lets an attacker alter connection configuration and supply or replace credentials/parameters so trusted workflows route through attacker-controlled or attacker-accessible backends, and can seed attacker-owned credentials for persistent authenticated access.

Risks

1. Data manipulation (HIGH)
2. Account persistence (BOOST)
3. Lateral movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links