azure-adf-factory-write-config

id: azure-adf-factory-write-config
emits: CanModifyConfiguration
description: Modify factory-level config (identity block, Git integration, public network access) via
  factories/write.
match_effective_permission:
  action: Microsoft.DataFactory/factories/write
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <Data Factory>
  permissions:
  - Microsoft.DataFactory/factories/write
  conditions: []
  state_logic: "ACTIVE when the effective permission is confirmed. Changing the identity block (attach/detach\
    \ user-assigned MI) requires BOTH factories/write AND assign/action on the MI \u2014 that compound\
    \ is the CanAttachIdentity path (rule azure-adf-attach-user-mi), not this rule alone. This rule covers\
    \ configuration changes that do not require a separate MI assign action (Git integration pointer,\
    \ public network access flag, CMK encryption key swap, global parameters). BLOCKED if a deny assignment\
    \ covers factories/write."
  confidence: 0.9
  derived_from:
  - 'effective permission: Microsoft.DataFactory/factories/write'
  false_positive_note: factories/write alone does NOT attach a user-assigned MI (that requires the separate
    assign/action on the MI resource). It CAN enable a system-assigned MI (identity.type=SystemAssigned),
    but the newly created system-assigned SP has no RBAC grants by default. Redirect Git integration to
    an attacker repo is a supply-chain CanModifyCode path (cicd-chains framing) that overlaps with azure-adf-pipeline-write-modifycode
    when the factory syncs from Git.
  narrative: '{principal.name} can modify factory-level configuration of {target.name} (Microsoft.DataFactory/factories/write),
    including the Git integration pointer, public network access, and global parameters.'