azure-adf-createrun-invoke
Directly trigger a pipeline run via pipelines/createRun/action (requires Contributor/Owner or a custom role - NOT Data Factory Contributor).
match (effective permission)
{
"action": "Microsoft.DataFactory/factories/pipelines/createRun/action",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Workflow |
| source | <principal> |
| target | <ADF pipeline (Workflow node)> |
| permissions | Microsoft.DataFactory/factories/pipelines/createRun/action |
| conditions | service_state |
| state logic | ACTIVE when the effective permission is confirmed and the factory is enabled (not paused). CONDITIONAL(service_state) if the factory has a suspended/paused integration runtime that the pipeline depends on. BLOCKED if a deny assignment covers createRun/action. NOTE: createRun/action is a DATA action not included in Data Factory Contributor — requires Contributor, Owner, or an explicit custom role grant. |
Narrative
{principal.name} can directly invoke a pipeline run on {target.name} (Microsoft.DataFactory/factories/pipelines/createRun/action), providing the trigger path needed to realize CanExecuteAs on the factory MI.
Raw rule rules/derived/azure/datafactory.yaml
id: azure-adf-createrun-invoke
emits: CanInvoke
description: "Directly trigger a pipeline run via pipelines/createRun/action (requires Contributor/Owner\
\ or a custom role \u2014 NOT Data Factory Contributor)."
match_effective_permission:
action: Microsoft.DataFactory/factories/pipelines/createRun/action
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Workflow
source: <principal>
target: <ADF pipeline (Workflow node)>
permissions:
- Microsoft.DataFactory/factories/pipelines/createRun/action
conditions:
- service_state
state_logic: "ACTIVE when the effective permission is confirmed and the factory is enabled (not paused).\
\ CONDITIONAL(service_state) if the factory has a suspended/paused integration runtime that the pipeline\
\ depends on. BLOCKED if a deny assignment covers createRun/action. NOTE: createRun/action is a DATA\
\ action not included in Data Factory Contributor \u2014 requires Contributor, Owner, or an explicit\
\ custom role grant."
confidence: 0.95
derived_from:
- 'effective permission: Microsoft.DataFactory/factories/pipelines/createRun/action'
false_positive_note: "createRun/action is NOT in the Data Factory Contributor built-in role. Only Contributor,\
\ Owner, or a custom role explicitly granting this data action allows direct run invocation. Do NOT\
\ emit CanInvoke for a principal holding only Data Factory Contributor. This CanInvoke completes the\
\ trigger path for can-execute-as execute-as-via-code-modify (optional[0] clause) \u2014 confirm the\
\ principal holds BOTH pipelines/write AND createRun/action for a fully ACTIVE CanExecuteAs."
narrative: '{principal.name} can directly invoke a pipeline run on {target.name} (Microsoft.DataFactory/factories/pipelines/createRun/action),
providing the trigger path needed to realize CanExecuteAs on the factory MI.'