azure-adf-trigger-start
Start a stopped ADF trigger to realize CONDITIONAL(trigger_exists) execution edges.
match (effective permission)
{
"action": "Microsoft.DataFactory/factories/triggers/start/action",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Scheduler |
| source | <principal> |
| target | <ADF trigger (Scheduler / EventRule node)> |
| permissions | Microsoft.DataFactory/factories/triggers/start/action |
| state logic | ACTIVE when the effective permission is confirmed. Needed to realize any CONDITIONAL(trigger_exists) or CONDITIONAL(service_state) execution edge on a Stopped trigger. BLOCKED if a deny assignment covers triggers/start/action. |
Narrative
{principal.name} can start a Stopped ADF trigger (triggers/start/action), realizing pipeline execution paths that were CONDITIONAL(trigger_exists).
Raw rule rules/derived/azure/datafactory.yaml
id: azure-adf-trigger-start
emits: CanModify
description: Start a stopped ADF trigger to realize CONDITIONAL(trigger_exists) execution edges.
match_effective_permission:
action: Microsoft.DataFactory/factories/triggers/start/action
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Scheduler
source: <principal>
target: <ADF trigger (Scheduler / EventRule node)>
permissions:
- Microsoft.DataFactory/factories/triggers/start/action
conditions: []
state_logic: ACTIVE when the effective permission is confirmed. Needed to realize any CONDITIONAL(trigger_exists)
or CONDITIONAL(service_state) execution edge on a Stopped trigger. BLOCKED if a deny assignment covers
triggers/start/action.
confidence: 0.95
derived_from:
- 'effective permission: Microsoft.DataFactory/factories/triggers/start/action'
false_positive_note: CanStart is not escalation by itself; it completes CONDITIONAL(trigger_exists)
edges (e.g., a pipeline has been modified but the trigger was Stopped). Combined with CanModifyCode(pipelines/write),
CanStart upgrades the CanExecuteAs from CONDITIONAL to ACTIVE. Do not derive CanModifyCode from this
action alone.
narrative: '{principal.name} can start a Stopped ADF trigger (triggers/start/action), realizing pipeline
execution paths that were CONDITIONAL(trigger_exists).'