azure-adf-dataplane-exposed

An ADF factory with publicNetworkAccess=Enabled exposes its REST data-plane endpoint (adfstudio.azure.com + management.azure.com) to the internet.

derived azure emits ExposedToInternet

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Data`
target type	`AnonymousIdentity`
source	`<Data Factory>`
target	`<AnonymousIdentity>`
conditions	`network_reachability`
state logic	CONDITIONAL(network_reachability): the factory REST API is publicly reachable but still requires valid Entra credentials or a data-plane access token — not unauthenticated. Emit CONDITIONAL(network_reachability) for public factories. BLOCKED if publicNetworkAccess=Disabled (private-endpoint-only mode), which forces all API traffic through the factory's private endpoint.

source type

Data

target type

AnonymousIdentity

source

<Data Factory>

target

<AnonymousIdentity>

conditions

network_reachability

state logic

CONDITIONAL(network_reachability): the factory REST API is publicly reachable but still requires valid Entra credentials or a data-plane access token — not unauthenticated. Emit CONDITIONAL(network_reachability) for public factories. BLOCKED if publicNetworkAccess=Disabled (private-endpoint-only mode), which forces all API traffic through the factory's private endpoint.

Narrative

Data Factory {factory.name} exposes its REST API on a public endpoint (publicNetworkAccess=Enabled); an actor with valid credentials can reach the factory from the internet to invoke pipeline runs or read linked services.

Raw rule rules/derived/azure/datafactory.yaml

id: azure-adf-dataplane-exposed
emits: ExposedToInternet
description: An ADF factory with publicNetworkAccess=Enabled exposes its REST data-plane endpoint (adfstudio.azure.com
  + management.azure.com) to the internet.
match:
- - factory: null
  - ExecutesAs
  - mi: null
where:
- node_type(?factory) in [AnalyticsService, Workflow]
- ?factory.publicNetworkAccess == Enabled (the default) OR publicNetworkAccess is absent
- no private-endpoint-only network policy restricts the factory REST API
emit:
  source_type: Data
  target_type: AnonymousIdentity
  source: <Data Factory>
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - network_reachability
  state_logic: "CONDITIONAL(network_reachability): the factory REST API is publicly reachable but still\
    \ requires valid Entra credentials or a data-plane access token \u2014 not unauthenticated. Emit CONDITIONAL(network_reachability)\
    \ for public factories. BLOCKED if publicNetworkAccess=Disabled (private-endpoint-only mode), which\
    \ forces all API traffic through the factory's private endpoint."
  confidence: 0.75
  derived_from:
  - '<ExecutesAs edge: ?factory -> ?mi>'
  - factory.publicNetworkAccess == Enabled or absent
  false_positive_note: "Public reachability of the ADF REST endpoint is NOT unauthenticated \u2014 all\
    \ API calls require valid Entra auth (ARM or ADF data-plane token). Emit only CONDITIONAL(network_reachability)\
    \ to flag the internet-reachable surface; combine with a CanReadSecret(data-plane token) or CanInvoke(createRun)\
    \ for an actionable attack path. Do NOT emit ACTIVE (AnonymousIdentity cannot directly call ADF APIs).\
    \ When publicNetworkAccess=Disabled, emit BLOCKED."
  narrative: Data Factory {factory.name} exposes its REST API on a public endpoint (publicNetworkAccess=Enabled);
    an actor with valid credentials can reach the factory from the internet to invoke pipeline runs or
    read linked services.