Checking only scp can misinterpret app-only tokens or allow operations without the intended authorization gate. This hazard concerns another scenario: A custom API supports both user-level delegated access and daemon application calls, but its authorization code checks only the scope claim.

Mistaking report-only evaluation for an active access block can leave risky sessions permitted. This hazard concerns another scenario: A Conditional Access policy is created for administrators but left in report-only mode while the team assumes its grant controls are enforced.

Standing high-privilege access expands the time window for account misuse or accidental resource changes. This hazard concerns another scenario: An incident response team needs elevated Azure resource access only during approved investigations, but administrators have standing Owner access all week.

Key Vault key rotation manages cryptographic key versions while applications must handle resulting lifecycle changes. This mechanism is associated with a different case: A cryptographic signing service uses a Key Vault key whose expiration is near, but the team has no rotation schedule.

Aggregate cloud posture metrics depend on assessment scope and counted control recommendations. This mechanism is associated with a different case: A cloud project migrates resources to a new subscription and the security team compares secure scores without matching coverage.

Cloud workload protection requires an actionable alerting and remediation process in addition to detection. This mechanism is associated with a different case: A security team discovers malware scan results for storage objects but sends no alert to resource owners or remediation workflow.

Outbound access succeeds to the approved hostname and is denied to unrelated external destinations. That would be evidence for the separate situation: An Azure Firewall policy contains a network rule to permit HTTPS but application FQDN filtering is required for specific domains.

The networks use distinct address spaces and the desired peering traffic is routed without ambiguity. That would be evidence for the separate situation: A network team changes a VNet address space so it overlaps an existing peered network and expects peering to continue normally.

Application hostnames resolve to approved private access paths without an unintended public frontend. That would be evidence for the separate situation: An App Service Environment is configured for isolated applications, but the team leaves a public ingress design despite a private-only requirement.

Key Vault supports distinct authorization permission models; the selected model governs data-plane access. This mechanism is associated with a different case: A Key Vault administrator enables RBAC authorization but continues editing legacy vault access policies as if they remain the effective data access model.

Defender for Cloud multicloud connectors establish managed access to AWS resources for supported CSPM and protection capabilities. This mechanism is associated with a different case: A security architect enables Defender for Cloud for Azure but expects its resource inventory to automatically include a separate AWS account.

Microsoft Sentinel playbooks use Azure Logic Apps and require both invocation rights and destination authorization. This mechanism is associated with a different case: A Sentinel playbook successfully invokes a Logic App but cannot update an incident because its managed identity lacks rights.

Azure Network Security Groups evaluate prioritized inbound and outbound security rules using five-tuple flow matching. This mechanism is associated with a different case: A VM subnet has an NSG that allows inbound SSH from any internet address despite a requirement for administrative access from one jump subnet.

Private Endpoint reachability depends on network routing, DNS and service-specific access controls. This mechanism is associated with a different case: An application needs private access to a PaaS service through a central hub, but the owner creates a Private Endpoint only in an isolated VNet.

Peering connectivity and gateway transit are separate configuration choices in Azure hub-and-spoke networking. This mechanism is associated with a different case: A hub-spoke virtual network peering is established, but spokes attempt to use a hub VPN gateway without gateway transit settings.

ARM Reader access to storage resources does not by itself grant blob data permissions. This hazard concerns another scenario: A user has the Azure Reader management-plane role on a storage account and assumes it can download all blob contents.

Unnecessary public ingress exposes a background service that does not require inbound internet connectivity. This hazard concerns another scenario: An Azure Container App permits unauthenticated public ingress for an internal worker that only needs message-queue access.

Removing key permissions or disabling the active encryption key can render protected data inaccessible. This hazard concerns another scenario: An Azure Storage account uses platform-managed encryption but the customer requires control over the key lifecycle.

A token for the intended resource and correct scoped authorization allows the Function's approved operation. That would be evidence for the separate situation: A function app invokes an Azure resource endpoint using a managed identity but the service rejects its request with forbidden status.

Tests with a representative identity allow restarting an approved virtual machine and deny deletion or role assignment. That would be evidence for the separate situation: A security engineer must allow one operations team to restart virtual machines but not delete or redeploy them.

A sample activation is blocked until approved verification is satisfied and produces auditable activation history. That would be evidence for the separate situation: A privileged directory role is eligible in PIM but the user can activate it without an MFA check or justification.

Combine Defender for Cloud resource inventory, exposure findings and supported attack-path or graph views. This is a valid action in another context: A security team wants to investigate whether sensitive database resources are exposed through network paths to the internet.

Evaluate supported agentless machine scanning in the selected Defender for Servers or CSPM plan and scope. This is a valid action in another context: A security team wants vulnerability coverage of Azure virtual machines without deploying a traditional scanning agent on every host.

Separate roles and enable available vault security features such as soft delete, resource locks or immutability as applicable. This is a valid action in another context: A Recovery Services vault permits the same operator who creates backups to disable protections and delete recovery points.

Apply appropriate network firewall or private endpoint controls as well as encryption at rest. This is a valid action in another context: An Azure SQL server is public and a DBA tries to secure it solely by enabling Transparent Data Encryption.

Protect the audit destination with appropriate access, network controls and retention before relying on its records. This is a valid action in another context: A database owner enables security auditing but places its audit storage account in an unrestricted public container.

Perform a supported test restore with protected backup permissions and validate the restored workload before approval. This is a valid action in another context: An Azure VM backup is successful, but no test verifies the recovered machine can boot in an isolated network.

Assign the least-privileged appropriate Azure RBAC reader role at the required management-group scope. This is a valid action in another context: A central team needs read-only security posture visibility across a management group without modifying any descendant subscriptions.

Restrict the identity's storage data-plane role assignment or assign a dedicated managed identity to the required workload. This is a valid action in another context: A storage automation client uses a user-assigned managed identity attached to several virtual machines but only one needs blob write access.

Protect designated emergency access accounts with controlled exclusions, monitoring and secure credential custody following a documented design. This is a valid action in another context: An emergency administration account is mistakenly targeted by a Conditional Access block policy that denies every administrator access during an outage.

A route entry outside the subnet's effective routing context cannot force desired network traffic inspection. This hazard concerns another scenario: A team creates a user-defined route sending egress traffic toward a firewall but sees the default system route still used for a workload subnet.

Central security policies applied to an overbroad network group can propagate unintended deny or allow behavior. This hazard concerns another scenario: A Virtual Network Manager configuration targets the wrong network group and unexpectedly includes a sensitive production subnet.

Firewall deployment without traffic steering does not guarantee egress inspection. This hazard concerns another scenario: An Azure Firewall is deployed but a workload egress connection bypasses it through an existing default route.