Azure App Service is a platform that allows you to run web apps, APIs, or mobile backends without managing servers. It takes care of the underlying infrastructure and supports multiple runtimes. It also integrates with code repositories to automate build and deployment processes, making application delivery faster and more efficient.

​

In Azure, all management operations are handled by the Azure Resource Manager (ARM) API, which routes requests for creating, updating or deleting resources. Access via ARM API is controlled via role-based access control (RBAC), so users including guests with no default permissions can act only if appropriate role is assigned at a specific scope. However, this raises an important question: what happens when certain ARM API endpoints do not behave as expected?

​

In this webinar, we will explore how some ARM API endpoints particularly those that operate at a global level can be abused to bypass traditional RBAC authorization boundaries. We will analyze their behavior, demonstrate how they can be leveraged to retrieve sensitive information from resources in a target tenant, and discuss the potential impact of such techniques. Finally, we will cover practical mitigations to help reduce the associated risks.