Microsoft Azure AI Foundry: Unauthorized API key and connection secret access

Microsoft Foundry (Azure AI Services) accounts store API keys that grant inference access across all model deployments, bypassing Entra ID conditional access. These accounts and projects also store connection secrets for downstream services such as Azure OpenAI, storage, and search. Threat actors use compromised high-privilege identities to retrieve these keys or secrets as a primary step for LLMjacking and lateral movement into connected data resources.

Impact

Successful retrieval of API keys enables unauthorized inference usage, leading to potential financial loss and data exposure. Disclosure of connection secrets allows attackers to pivot from an AI project to integrated Azure services.

Recommendation

• Monitor Azure Activity Logs for administrative operations involving key listing, regeneration, or secret retrieval by high-privilege principals.
• Prioritize the use of Entra ID authentication for AI services and set 'disableLocalAuth' on Foundry accounts where key-based access is not strictly required.
• Review and audit high-privilege roles (e.g., Owner, Contributor) assigned to AI resource groups.
• Exclude automated service principals from monitoring via an allowlist if they require routine access to secrets for deployment pipelines.