Providers
Native resource types mapped to the RAGE taxonomy, their collection recipes, and the fact recipes that back edges. Switch cloud:
What's modeled
44 services · 60 resource types · 9 clustersWhat RAGE covers for AZURE today, grouped by the kind of thing each service is.
Data
16Structured data services - relational/NoSQL databases, warehouses, caches, search and analytics stores holding queryable data.
AI SearchAzure DatabricksAzure MLAzure OpenAI / AI ServicesAzure SQL / SQL MICache for RedisCosmos DBData Lake Storage Gen2DB for PostgreSQL/MySQLhdinsightkustomariadbMicrosoft PurviewmysqlstreamanalyticsSynapse Analytics
Compute
7Resources that execute attacker-influenceable code and usually run AS an identity.
AKSAzure BatchAzure FunctionsContainer AppsContainer InstancesService FabricVM Scale Sets
Messaging
7Integration primitives that can trigger execution or carry credentials.
apimEvent GridEvent HubsLogic AppsNotification HubsService Bussignalr
Storage
5Durable data-at-rest stores - objects, files, blocks, snapshots, backups, and artifact/image repositories an attacker reads, writes, or exfiltrates.
Azure NetApp FilesContainer RegistryrecoveryservicesStorage Accounts (Blob/File/Queue/Table)VM Scale Sets
AdministrativeBoundary
2Containers that scope permissions, policy inheritance, and control.
Management Groupssubscription
Identity
2Any principal that can hold permissions or be authenticated as.
Entra IDManaged Identities
ManagementService
2Control-plane & security services whose abuse enables execution, persistence, or evasion.
Azure AutomationData Factory
Network
2Connectivity and reachability primitives (networks, subnets, firewalls, routes, endpoints) that gate whether one resource can reach another.
Azure Firewallcdn
Secret
2Credential and cryptographic material - terminal targets and pivots.
App ConfigurationManaged HSM
Resource types 60
| resource | maps to | scope | enumerate | permissions |
|---|---|---|---|---|
azure:aci:containergroup |
ContainerService |
global | arg:microsoft.containerinstance/containergroups |
Microsoft.ContainerInstance/containergroups/read |
azure:aks:cluster |
KubernetesCluster |
global | arg:microsoft.containerservice/managedclusters |
Microsoft.ContainerService/managedclusters/read |
azure:apim:service |
APIGateway |
global | arg:microsoft.apimanagement/service |
Microsoft.ApiManagement/service/read |
azure:app:containerapp |
ContainerService |
global | arg:microsoft.app/containerapps |
Microsoft.App/containerapps/read |
azure:appconfig:store |
Secret |
global | arg:microsoft.appconfiguration/configurationstores |
Microsoft.AppConfiguration/configurationstores/read |
azure:automation:account |
AutomationService |
global | arg:microsoft.automation/automationaccounts |
Microsoft.Automation/automationaccounts/read |
azure:batch:account |
BatchJob |
global | arg:microsoft.batch/batchaccounts |
Microsoft.Batch/batchaccounts/read |
azure:cache:redis |
Cache |
global | arg:microsoft.cache/redis |
Microsoft.Cache/redis/read |
azure:cdn:profile |
LoadBalancer |
global | arg:microsoft.cdn/profiles |
Microsoft.Cdn/profiles/read |
azure:cognitiveservices:account |
AnalyticsService |
global | arg:microsoft.cognitiveservices/accounts |
Microsoft.CognitiveServices/accounts/read |
azure:compute:disk |
BlockStorage |
global | arg:microsoft.compute/disks |
Microsoft.Compute/disks/read |
azure:compute:snapshot |
Snapshot |
global | arg:microsoft.compute/snapshots |
Microsoft.Compute/snapshots/read |
azure:compute:vm |
VirtualMachine |
global | arg:microsoft.compute/virtualmachines |
Microsoft.Compute/virtualmachines/read |
azure:compute:vmss |
VirtualMachine |
global | arg:microsoft.compute/virtualmachinescalesets |
Microsoft.Compute/virtualmachinescalesets/read |
azure:containerregistry:registry |
ContainerRegistry |
global | arg:microsoft.containerregistry/registries |
Microsoft.ContainerRegistry/registries/read |
azure:databricks:workspace |
AnalyticsService |
global | arg:microsoft.databricks/workspaces |
Microsoft.Databricks/workspaces/read |
azure:datafactory:factory |
AutomationService |
global | arg:microsoft.datafactory/factories |
Microsoft.DataFactory/factories/read |
azure:datalake:store |
DataLake |
global | arg:microsoft.datalakestore/accounts |
Microsoft.DataLakeStore/accounts/read |
azure:documentdb:cosmos |
NoSQLDatabase |
global | arg:microsoft.documentdb/databaseaccounts |
Microsoft.DocumentDB/databaseaccounts/read |
azure:entra:group |
Group |
global | msgraph:groups.list |
Group.Read.All |
azure:entra:serviceprincipal |
ApplicationIdentity |
global | msgraph:servicePrincipals.list |
Application.Read.All |
azure:entra:user |
HumanIdentity |
global | msgraph:users.list |
User.Read.All |
azure:eventgrid:topic |
Topic |
global | arg:microsoft.eventgrid/topics |
Microsoft.EventGrid/topics/read |
azure:eventhub:namespace |
EventBus |
global | arg:microsoft.eventhub/namespaces |
Microsoft.EventHub/namespaces/read |
azure:hdinsight:cluster |
AnalyticsService |
global | arg:microsoft.hdinsight/clusters |
Microsoft.HDInsight/clusters/read |
azure:keyvault:managedhsm |
EncryptionKey |
global | arg:microsoft.keyvault/managedhsms |
Microsoft.KeyVault/managedhsms/read |
azure:keyvault:vault |
Secret |
global | arg:microsoft.keyvault/vaults |
Microsoft.KeyVault/vaults/read |
azure:kusto:cluster |
AnalyticsService |
global | arg:microsoft.kusto/clusters |
Microsoft.Kusto/clusters/read |
azure:logic:workflow |
Workflow |
global | arg:microsoft.logic/workflows |
Microsoft.Logic/workflows/read |
azure:managedidentity:userassigned |
ManagedIdentity |
global | arg:microsoft.managedidentity/userassignedidentities |
Microsoft.ManagedIdentity/userassignedidentities/read |
azure:management:managementgroup |
ManagementGroup |
tenant | Microsoft.Management/managementGroups (list) |
Microsoft.Management/managementGroups/read |
azure:mariadb:server |
RelationalDatabase |
global | arg:microsoft.dbformariadb/servers |
Microsoft.DBforMariaDB/servers/read |
azure:ml:workspace |
AnalyticsService |
global | arg:microsoft.machinelearningservices/workspaces |
Microsoft.MachineLearningServices/workspaces/read |
azure:mysql:flexibleserver |
RelationalDatabase |
global | arg:microsoft.dbformysql/flexibleservers |
Microsoft.DBforMySQL/flexibleservers/read |
azure:netapp:account |
FileStorage |
global | arg:microsoft.netapp/netappaccounts |
Microsoft.NetApp/netappaccounts/read |
azure:network:appgateway |
LoadBalancer |
global | arg:microsoft.network/applicationgateways |
Microsoft.Network/applicationgateways/read |
azure:network:firewall |
Firewall |
global | arg:microsoft.network/azurefirewalls |
Microsoft.Network/azurefirewalls/read |
azure:network:loadbalancer |
LoadBalancer |
global | arg:microsoft.network/loadbalancers |
Microsoft.Network/loadbalancers/read |
azure:network:nic |
NetworkInterface |
region | arg:microsoft.network/networkinterfaces |
Microsoft.Network/networkInterfaces/read |
azure:network:nsg |
Firewall |
global | arg:microsoft.network/networksecuritygroups |
Microsoft.Network/networksecuritygroups/read |
azure:network:privateendpoint |
PrivateEndpoint |
region | arg:microsoft.network/privateendpoints |
Microsoft.Network/privateEndpoints/read |
azure:network:subnet |
Subnet |
region | arg:microsoft.network/virtualnetworks/subnets |
Microsoft.Network/virtualNetworks/subnets/read |
azure:network:vnet |
VirtualNetwork |
global | arg:microsoft.network/virtualnetworks |
Microsoft.Network/virtualnetworks/read |
azure:notificationhubs:namespace |
Topic |
global | arg:microsoft.notificationhubs/namespaces |
Microsoft.NotificationHubs/namespaces/read |
azure:postgresql:flexibleserver |
RelationalDatabase |
global | arg:microsoft.dbforpostgresql/flexibleservers |
Microsoft.DBforPostgreSQL/flexibleservers/read |
azure:postgresql:server |
RelationalDatabase |
global | arg:microsoft.dbforpostgresql/servers |
Microsoft.DBforPostgreSQL/flexibleServers/read |
azure:purview:account |
AnalyticsService |
global | arg:microsoft.purview/accounts |
Microsoft.Purview/accounts/read |
azure:recoveryservices:vault |
Backup |
global | arg:microsoft.recoveryservices/vaults |
Microsoft.RecoveryServices/vaults/read |
azure:resources:resourcegroup |
ResourceGroup |
subscription | Microsoft.Resources/subscriptions/resourceGroups (list) |
Microsoft.Resources/subscriptions/resourceGroups/read |
azure:resources:subscription |
Subscription |
tenant | Microsoft.Resources/subscriptions (list) |
Microsoft.Resources/subscriptions/read |
azure:search:service |
SearchService |
global | arg:microsoft.search/searchservices |
Microsoft.Search/searchservices/read |
azure:servicebus:namespace |
Queue |
global | arg:microsoft.servicebus/namespaces |
Microsoft.ServiceBus/namespaces/read |
azure:servicefabric:cluster |
ContainerCluster |
global | arg:microsoft.servicefabric/clusters |
Microsoft.ServiceFabric/clusters/read |
azure:signalr:service |
GenericMessaging |
global | arg:microsoft.signalrservice/signalr |
Microsoft.SignalRService/signalr/read |
azure:sql:server |
RelationalDatabase |
global | arg:microsoft.sql/servers |
Microsoft.Sql/servers/read |
azure:storage:account |
ObjectStorage |
global | arg:microsoft.storage/storageaccounts |
Microsoft.Storage/storageaccounts/read |
azure:streamanalytics:job |
AnalyticsService |
global | arg:microsoft.streamanalytics/streamingjobs |
Microsoft.StreamAnalytics/streamingjobs/read |
azure:synapse:workspace |
AnalyticsService |
global | arg:microsoft.synapse/workspaces |
Microsoft.Synapse/workspaces/read |
azure:web:site |
ApplicationPlatform |
global | arg:microsoft.web/sites |
Microsoft.Web/sites/read |
azure:web:staticsite |
ApplicationPlatform |
global | arg:microsoft.web/staticsites |
Microsoft.Web/staticsites/read |
Fact recipes 9
Facts are the relationship data (policies, bindings, trust, network, credentials) that back edges.
| fact kind | collect | backs edges | permissions |
|---|---|---|---|
role_assignment |
Microsoft.Authorization/roleAssignments (list)over azure:subscription, azure:resourcegroup, any resource scope |
HasRole HasPermission |
Microsoft.Authorization/roleAssignments/read |
role_definition |
Microsoft.Authorization/roleDefinitions (list)over azure:subscription |
HasPermission |
Microsoft.Authorization/roleDefinitions/read |
deny_assignment |
Microsoft.Authorization/denyAssignments (list)over azure:subscription |
Microsoft.Authorization/denyAssignments/read |
|
mg_hierarchy |
Microsoft.Management/managementGroups (list + descendants)over azure:managementgroup |
Contains CanEnterSubscription CanEnterTenant |
Microsoft.Management/managementGroups/read |
entra_role_assignment |
msgraph roleManagement.directory.roleAssignments + roleEligibilityScheduleInstancesover azure:entra:user, azure:entra:serviceprincipal, azure:entra:group |
HasRole CanGrantPermission |
RoleManagement.Read.Directory |
entra_owner |
msgraph owners (application/servicePrincipal/group owners)over azure:entra:serviceprincipal, azure:entra:group |
CanControl CanCreateCredentialFor |
Application.Read.All Directory.Read.All |
entra_app_role |
msgraph appRoleAssignments / oauth2PermissionGrantsover azure:entra:serviceprincipal |
HasPermission CanGrantPermission |
Application.Read.All Directory.Read.All |
membership |
msgraph group members (transitiveMembers)over azure:entra:group |
MemberOf |
GroupMember.Read.All |
resource_policy |
Key Vault access policies / storage account public access / resource-scope role assignmentsover azure:keyvault:vault, azure:storage:account |
HasPolicy CanReadSecret CanDecrypt ExposedToInternet |
Microsoft.KeyVault/vaults/read Microsoft.Storage/storageAccounts/read |
Least-privilege permission set
Every enumerate permission this cloud's resource recipes require - copy as a single collector policy.
Application.Read.All Group.Read.All Microsoft.ApiManagement/service/read Microsoft.App/containerapps/read Microsoft.AppConfiguration/configurationstores/read Microsoft.Automation/automationaccounts/read Microsoft.Batch/batchaccounts/read Microsoft.Cache/redis/read Microsoft.Cdn/profiles/read Microsoft.CognitiveServices/accounts/read Microsoft.Compute/disks/read Microsoft.Compute/snapshots/read Microsoft.Compute/virtualmachines/read Microsoft.Compute/virtualmachinescalesets/read Microsoft.ContainerInstance/containergroups/read Microsoft.ContainerRegistry/registries/read Microsoft.ContainerService/managedclusters/read Microsoft.DBforMariaDB/servers/read Microsoft.DBforMySQL/flexibleservers/read Microsoft.DBforPostgreSQL/flexibleServers/read Microsoft.DBforPostgreSQL/flexibleservers/read Microsoft.DataFactory/factories/read Microsoft.DataLakeStore/accounts/read Microsoft.Databricks/workspaces/read Microsoft.DocumentDB/databaseaccounts/read Microsoft.EventGrid/topics/read Microsoft.EventHub/namespaces/read Microsoft.HDInsight/clusters/read Microsoft.KeyVault/managedhsms/read Microsoft.KeyVault/vaults/read Microsoft.Kusto/clusters/read Microsoft.Logic/workflows/read Microsoft.MachineLearningServices/workspaces/read Microsoft.ManagedIdentity/userassignedidentities/read Microsoft.Management/managementGroups/read Microsoft.NetApp/netappaccounts/read Microsoft.Network/applicationgateways/read Microsoft.Network/azurefirewalls/read Microsoft.Network/loadbalancers/read Microsoft.Network/networkInterfaces/read Microsoft.Network/networksecuritygroups/read Microsoft.Network/privateEndpoints/read Microsoft.Network/virtualNetworks/subnets/read Microsoft.Network/virtualnetworks/read Microsoft.NotificationHubs/namespaces/read Microsoft.Purview/accounts/read Microsoft.RecoveryServices/vaults/read Microsoft.Resources/subscriptions/read Microsoft.Resources/subscriptions/resourceGroups/read Microsoft.Search/searchservices/read Microsoft.ServiceBus/namespaces/read Microsoft.ServiceFabric/clusters/read Microsoft.SignalRService/signalr/read Microsoft.Sql/servers/read Microsoft.Storage/storageaccounts/read Microsoft.StreamAnalytics/streamingjobs/read Microsoft.Synapse/workspaces/read Microsoft.Web/sites/read Microsoft.Web/staticsites/read User.Read.All