Retail Technology Trends (blog)

Common Azure Privilege Escalation Paths Attackers Exploit

Azure privilege escalation typically follows a chain of modest misconfigurations rather than a single dramatic exploit. Attackers often start with a user who owns an application registration, add a client secret, and leverage the app’s permissions to read directory data or manage the subscription. Managed identities on virtual machines can inadvertently grant subscription‑wide read rights, while custom RBAC roles may contain overly broad actions that expand access. Robust auditing and careful role reviews are essential to break these escalation paths.