azure-adf-get-dataplane-access

id: azure-adf-get-dataplane-access
emits: CanReadSecret
description: Obtain a short-lived ADF data-plane access token (getDataPlaneAccess/action) scoped to factory
  Author/Monitor/DataAccess operations.
match_effective_permission:
  action: Microsoft.DataFactory/factories/getDataPlaneAccess/action
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: Secret
  source: <principal>
  target: <ADF data-plane access token (Token node) scoped to the factory>
  permissions:
  - Microsoft.DataFactory/factories/getDataPlaneAccess/action
  conditions: []
  state_logic: ACTIVE when the effective permission is confirmed. The returned token is short-lived (1
    hour) and scoped to ADF data-plane operations (Author, Monitor, DataAccess roles within the factory).
    BLOCKED if a deny assignment covers the action.
  confidence: 0.88
  derived_from:
  - 'effective permission: Microsoft.DataFactory/factories/getDataPlaneAccess/action'
  false_positive_note: "The data-plane access token is scoped to ADF Author/Monitor/DataAccess operations\
    \ \u2014 it does NOT grant broader Azure ARM access (not a factory-MI bearer token). It allows ADF\
    \ REST data-plane calls (list pipelines, trigger runs, read run history) within the factory. Do not\
    \ conflate with a factory-MI token. Lower impact than CanReadSecret on a linked service with SP creds\
    \ or a storage key."
  narrative: '{principal.name} can obtain a short-lived ADF data-plane access token for factory {target.name}
    (getDataPlaneAccess/action), enabling ADF REST data-plane calls (Author / Monitor / DataAccess) without
    ARM credentials.'