APIKey

A SecureString parameter exposes credential material to any reader.

A listKeys holder uses the access-key connection string to read every secret key-value, bypassing data-plane RBAC.

App Configuration Data Owner (*/read incl. keyValues/read) can read a secret key-value.

App Configuration Data Reader (keyValues/read) can read a key-value that holds credential material.

snapshots/read returns the key-values frozen in a snapshot, including secret ones.

The search service exposes its primary and secondary admin API keys (discoverable via listAdminKeys/action by principals holding Search Service Contributor, Contributor, or Owner roles). Admin keys grant full data-plane control of the search service (all indexes, indexers, data sources, and queries).

The search service exposes one or more query API keys (discoverable via listQueryKeys/action by principals holding Search Service Contributor, Contributor, or Owner roles). Query keys grant read-only data-plane access (search, suggest, autocomplete queries against all indexes).

A principal that can obtain an admin or query key (via ExposesCredential) can issue search, suggest, and autocomplete queries against all indexes in the service, reading the full content of matching indexed documents.

Read SAS signing keys for an entity-level (event-hub) authorization rule via listkeys/action; keys are scoped to one event hub.

Read SAS signing keys for a namespace-level authorization rule via listkeys/action; the primary and secondary keys can forge SAS tokens for all event hubs in the namespace.

A namespace or entity authorization rule with usable SAS keys (disableLocalAuth=false) embeds connection-string credential material; any holder of the keys can authenticate to the Event Hubs data plane.

Invoke a Logic App HTTP trigger using a held callback URL (SAS-signed).

Retrieve all PNS credentials (APNS cert/token, FCM API key, WNS packageSid+secret, etc.) from a Notification Hub via ARM pnsCredentials; credentials are reusable outside Azure.

listKeys or regenerateKey on an Azure OpenAI account retrieves symmetric API keys that authenticate to all model deployments.

A Static Web App exposes its deployment token as a credential for the CI/CD pipeline identity.

Retrieve the SWA deployment token (AZURE_STATIC_WEB_APPS_API_TOKEN) via listSecrets/action.

A holder of the SWA deployment token can modify the build runner's deployment when a runner with a service identity exists.