Andreas Wolter notes some security requirements:
Azure Arc for SQL Server comes with a so-called “least privilege mode.”
But certain Azure Arc components still execute SQL Server operations with sysadmin authority, which can expose that authority to database-scoped code.
Fabiano Amorim recently demonstrated how a database-scoped principal can take advantage of exactly this privileged execution context to escalate to sysadmin through a database-level DDL trigger: How Azure Arc allows a DB admin to become SQL Server sysadmin – the vulnerability explained
Fabiano covers the exploit itself in detail. What I want to put under the magnifying glass here is the “least privilege” mode itself – a topic I have written about extensively:
Click through for Andreas’s take on this.