Microsoft.AppConfiguration/configurationStores/listKeys/action

Azure

Microsoft.AppConfiguration/configurationStores/listKeys/action

service: Azure - App Configuration

tactics:

Credential Access Discovery

techniques:

T1552 T1526

tags:

Azure App Configuration

Event

Lists the access keys for an Azure App Configuration store, exposing credentials used to read or write configuration data.

Security Context

Enumerating cloud resources helps adversaries map the environment to identify high-value targets, security controls, and potential pivot points.
Accessing stored credentials or secrets can provide adversaries with keys to additional systems, enabling lateral movement and privilege escalation.

Log Source

Azure Activity Log

Sample Event

Adversarial. Compromised user draco@fantasticlogs.cloud calls ListKeys on the production App Configuration store appconf-occamy-prod to harvest its connection strings (one read-only, one read-write) for offline use. Connection strings contain the store endpoint and a primary key; once exfiltrated they survive any rotation of Draco’s own credentials and grant data-plane access to every key/value in the store (typical store contents: feature flags, downstream API keys, DB connection strings).

{
  "authorization": {
    "action": "Microsoft.AppConfiguration/configurationStores/ListKeys/action",
    "scope": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.AppConfiguration/configurationStores/appconf-occamy-prod"
  },
  "caller": "draco@fantasticlogs.cloud",
  "channels": "Operation",
  "claims": {
    "aud": "https://management.core.windows.net/",
    "iss": "https://sts.windows.net/10000000-0000-4000-8000-000000000001/",
    "appid": "04b07795-8ddb-461a-bbee-02f9e1bf7b46",
    "ipaddr": "203.0.113.66",
    "name": "Draco Malfoy",
    "http://schemas.microsoft.com/identity/claims/objectidentifier": "30000000-0000-4000-8000-001010011010",
    "http://schemas.microsoft.com/identity/claims/tenantid": "10000000-0000-4000-8000-000000000001",
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn": "draco@fantasticlogs.cloud"
  },
  "correlationId": "90000000-0000-4000-8000-000001110100",
  "description": "",
  "eventDataId": "90000000-0000-4000-8000-000001110101",
  "eventName": {
    "value": "EndRequest",
    "localizedValue": "End request"
  },
  "category": {
    "value": "Administrative",
    "localizedValue": "Administrative"
  },
  "eventTimestamp": "2026-04-15T19:58:32.6172843Z",
  "id": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.AppConfiguration/configurationStores/appconf-occamy-prod/events/90000000-0000-4000-8000-000001110101/ticks/638798181126172843",
  "level": "Informational",
  "operationId": "90000000-0000-4000-8000-000001110110",
  "operationName": {
    "value": "Microsoft.AppConfiguration/configurationStores/ListKeys/action",
    "localizedValue": "List App Configuration store keys"
  },
  "resourceGroupName": "rg-occamy-pipeline",
  "resourceProviderName": {
    "value": "Microsoft.AppConfiguration",
    "localizedValue": "Microsoft App Configuration"
  },
  "resourceType": {
    "value": "Microsoft.AppConfiguration/configurationStores",
    "localizedValue": "Microsoft.AppConfiguration/configurationStores"
  },
  "resourceId": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.AppConfiguration/configurationStores/appconf-occamy-prod",
  "status": {
    "value": "Succeeded",
    "localizedValue": "Succeeded"
  },
  "subStatus": {
    "value": "OK",
    "localizedValue": "OK (HTTP Status Code: 200)"
  },
  "submissionTimestamp": "2026-04-15T19:58:33.0184215Z",
  "subscriptionId": "20000000-0000-4000-8000-000000000001",
  "tenantId": "10000000-0000-4000-8000-000000000001",
  "properties": {
    "statusCode": "OK",
    "serviceRequestId": null,
    "eventCategory": "Administrative",
    "entity": "/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.AppConfiguration/configurationStores/appconf-occamy-prod",
    "message": "Microsoft.AppConfiguration/configurationStores/ListKeys/action",
    "hierarchy": "10000000-0000-4000-8000-000000000001/20000000-0000-4000-8000-000000000001"
  },
  "relatedEvents": [],
  "httpRequest": {
    "clientRequestId": "90000000-0000-4000-8000-000001110111",
    "clientIpAddress": "203.0.113.66",
    "method": "POST",
    "url": "https://management.azure.com/subscriptions/20000000-0000-4000-8000-000000000001/resourceGroups/rg-occamy-pipeline/providers/Microsoft.AppConfiguration/configurationStores/appconf-occamy-prod/listKeys?api-version=2023-03-01"
  },
  "identity": null
}

MITRE ATT&CK Mapping

Tactics: Credential Access Discovery

Techniques:

T1552 — Unsecured Credentials — Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or applica...
T1526 — Cloud Service Discovery — An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can...

Microsoft.AppConfiguration/configurationStores/listKeys/action

Event

Security Context

Log Source

Sample Event

MITRE ATT&CK Mapping

Related Events