azure-adf-contributor
Full control of an ADF factory (Data Factory Contributor / Contributor / Owner).
match (effective permission)
{
"action": "Microsoft.DataFactory/factories/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Data Factory Contributor, Contributor, Owner, or a custom role granting Microsoft.DataFactory/factories/* at the scope
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <Data Factory (Microsoft.DataFactory/factories) in scope> |
| permissions | Microsoft.DataFactory/factories/write |
| state logic | ACTIVE when the effective permission is confirmed; BLOCKED if a deny assignment covers factories/write. CanAdminister on the factory does NOT imply CanGrantPermission — escalation is via the factory's managed identity, not self-role-assignment (Microsoft.Authorization/*/write is absent from Data Factory Contributor). Data Factory Contributor does NOT include pipelines/createRun/action; triggering runs requires Contributor/Owner or a custom role. |
Narrative
{principal.name} has full administrative control of Data Factory {target.name} (Microsoft.DataFactory/factories/*) including pipeline definitions, linked services, triggers, and identity configuration.
Raw rule rules/derived/azure/datafactory.yaml
id: azure-adf-contributor
emits: CanAdminister
description: Full control of an ADF factory (Data Factory Contributor / Contributor / Owner).
match_effective_permission:
action: Microsoft.DataFactory/factories/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Data Factory Contributor, Contributor, Owner, or a custom role granting
Microsoft.DataFactory/factories/* at the scope
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <Data Factory (Microsoft.DataFactory/factories) in scope>
permissions:
- Microsoft.DataFactory/factories/write
conditions: []
state_logic: "ACTIVE when the effective permission is confirmed; BLOCKED if a deny assignment covers\
\ factories/write. CanAdminister on the factory does NOT imply CanGrantPermission \u2014 escalation\
\ is via the factory's managed identity, not self-role-assignment (Microsoft.Authorization/*/write\
\ is absent from Data Factory Contributor). Data Factory Contributor does NOT include pipelines/createRun/action;\
\ triggering runs requires Contributor/Owner or a custom role."
confidence: 0.98
derived_from:
- 'effective permission: Microsoft.DataFactory/factories/write'
false_positive_note: "Data Factory Contributor grants Microsoft.DataFactory/factories/* including pipelines/write,\
\ linkedservices/write, triggers/write, but NOT Microsoft.Authorization/*/write and NOT pipelines/createRun/action.\
\ A principal with Data Factory Contributor can modify definitions but cannot directly trigger runs\
\ \u2014 only if they ALSO hold createRun/action (Contributor / Owner / custom role). Distinguish\
\ these when emitting downstream edges."
narrative: '{principal.name} has full administrative control of Data Factory {target.name} (Microsoft.DataFactory/factories/*)
including pipeline definitions, linked services, triggers, and identity configuration.'