azure-adf-createrun-invoke

Directly trigger a pipeline run via pipelines/createRun/action (requires Contributor/Owner or a custom role - NOT Data Factory Contributor).

derived azure emits CanInvoke

match (effective permission)

{ "action": "Microsoft.DataFactory/factories/pipelines/createRun/action", "scope_type": "resource|resourceGroup|subscription" }

emit

source typeIdentity
target typeWorkflow
source<principal>
target<ADF pipeline (Workflow node)>
permissionsMicrosoft.DataFactory/factories/pipelines/createRun/action
conditionsservice_state
state logicACTIVE when the effective permission is confirmed and the factory is enabled (not paused). CONDITIONAL(service_state) if the factory has a suspended/paused integration runtime that the pipeline depends on. BLOCKED if a deny assignment covers createRun/action. NOTE: createRun/action is a DATA action not included in Data Factory Contributor — requires Contributor, Owner, or an explicit custom role grant.

Narrative

{principal.name} can directly invoke a pipeline run on {target.name} (Microsoft.DataFactory/factories/pipelines/createRun/action), providing the trigger path needed to realize CanExecuteAs on the factory MI.

Raw rule rules/derived/azure/datafactory.yaml

id: azure-adf-createrun-invoke
emits: CanInvoke
description: "Directly trigger a pipeline run via pipelines/createRun/action (requires Contributor/Owner\
  \ or a custom role \u2014 NOT Data Factory Contributor)."
match_effective_permission:
  action: Microsoft.DataFactory/factories/pipelines/createRun/action
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: Workflow
  source: <principal>
  target: <ADF pipeline (Workflow node)>
  permissions:
  - Microsoft.DataFactory/factories/pipelines/createRun/action
  conditions:
  - service_state
  state_logic: "ACTIVE when the effective permission is confirmed and the factory is enabled (not paused).\
    \ CONDITIONAL(service_state) if the factory has a suspended/paused integration runtime that the pipeline\
    \ depends on. BLOCKED if a deny assignment covers createRun/action. NOTE: createRun/action is a DATA\
    \ action not included in Data Factory Contributor \u2014 requires Contributor, Owner, or an explicit\
    \ custom role grant."
  confidence: 0.95
  derived_from:
  - 'effective permission: Microsoft.DataFactory/factories/pipelines/createRun/action'
  false_positive_note: "createRun/action is NOT in the Data Factory Contributor built-in role. Only Contributor,\
    \ Owner, or a custom role explicitly granting this data action allows direct run invocation. Do NOT\
    \ emit CanInvoke for a principal holding only Data Factory Contributor. This CanInvoke completes the\
    \ trigger path for can-execute-as execute-as-via-code-modify (optional[0] clause) \u2014 confirm the\
    \ principal holds BOTH pipelines/write AND createRun/action for a fully ACTIVE CanExecuteAs."
  narrative: '{principal.name} can directly invoke a pipeline run on {target.name} (Microsoft.DataFactory/factories/pipelines/createRun/action),
    providing the trigger path needed to realize CanExecuteAs on the factory MI.'
move · open · esc close