Who polices your policies? Azure policy abuse for privileges escalation and persistence

This report examines the abuse potential of Azure Policy, showing how attackers can leverage policy effects (append, modify, deployIfNotExists) and policy assignments to disable logging, alter network rules, inject SSH keys, and deploy backdoor extensions, as well as escalate privileges via editing policy definitions and initiatives. It highlights the risks of the Resource Policy Contributor role, the prevalence of over-permissioned built-in policies, limited logging for certain effects, and recommends least-privilege configurations and monitoring of policy assignment and definition changes.