azure-adf-attach-user-mi

Attach a user-assigned managed identity to a Data Factory (factories/write + assign/action on the MI), binding a higher-privilege identity to the factory's pipeline runs.

derived azure emits CanAttachIdentity

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`AnalyticsService`
source	`<principal>`
target	`<Data Factory (AnalyticsService node)>`
permissions	`Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` `Microsoft.DataFactory/factories/write`
conditions	`role_compatibility`
state logic	ACTIVE when BOTH permissions are confirmed at their respective scopes and role_compatible(?userMI, ?factory) holds. POTENTIAL(role_compatibility) when the assign/action scope excludes the target MI. BLOCKED if a deny assignment covers either action.

source type

Identity

target type

AnalyticsService

source

<principal>

target

<Data Factory (AnalyticsService node)>

permissions

Microsoft.ManagedIdentity/userAssignedIdentities/assign/action Microsoft.DataFactory/factories/write

conditions

role_compatibility

state logic

ACTIVE when BOTH permissions are confirmed at their respective scopes and role_compatible(?userMI, ?factory) holds. POTENTIAL(role_compatibility) when the assign/action scope excludes the target MI. BLOCKED if a deny assignment covers either action.

Narrative

{principal.name} can attach user-assigned managed identity {userMI.name} to Data Factory {target.name} (assign/action + factories/write), binding a higher-privilege identity to all pipeline runs in the factory.

Raw rule rules/derived/azure/datafactory.yaml

id: azure-adf-attach-user-mi
emits: CanAttachIdentity
description: Attach a user-assigned managed identity to a Data Factory (factories/write + assign/action
  on the MI), binding a higher-privilege identity to the factory's pipeline runs.
match:
- - principal: null
  - CanPassIdentity
  - userMI: null
where:
- ?principal has EFFECTIVE Microsoft.ManagedIdentity/userAssignedIdentities/assign/action on ?userMI
- ?principal has EFFECTIVE Microsoft.DataFactory/factories/write on the target factory
emit:
  source_type: Identity
  target_type: AnalyticsService
  source: <principal>
  target: <Data Factory (AnalyticsService node)>
  permissions:
  - Microsoft.ManagedIdentity/userAssignedIdentities/assign/action
  - Microsoft.DataFactory/factories/write
  conditions:
  - role_compatibility
  state_logic: ACTIVE when BOTH permissions are confirmed at their respective scopes and role_compatible(?userMI,
    ?factory) holds. POTENTIAL(role_compatibility) when the assign/action scope excludes the target MI.
    BLOCKED if a deny assignment covers either action.
  confidence: 0.95
  derived_from:
  - '<CanPassIdentity edge: ?principal -> ?userMI>'
  false_positive_note: "BOTH permissions are required: assign/action on the specific user-assigned MI\
    \ AND factories/write on the target factory. Neither alone attaches the MI. Honor the assign/action\
    \ resource scope \u2014 a scope limited to a different MI does not qualify. Once attached, the factory's\
    \ pipelines execute as the new MI; can-execute-as execute-as-via-config-identity-swap collapses CanModifyConfiguration(?p,\
    \ ?factory) + CanPassIdentity(?p, ?mi) => CanExecuteAs(?p, ?mi) \u2014 cite, do not re-derive here.\
    \ System-assigned MI is enabled via factories/write alone but the new SP has no RBAC grants by default\
    \ \u2014 no immediate privilege gain without a subsequent role assignment."
  narrative: '{principal.name} can attach user-assigned managed identity {userMI.name} to Data Factory
    {target.name} (assign/action + factories/write), binding a higher-privilege identity to all pipeline
    runs in the factory.'