azure-adf-trigger-write-schedule
Create or modify an ADF trigger (Schedule / Tumbling Window) to fire pipelines autonomously as the factory MI - persistent execution.
match (effective permission)
{
"action": "Microsoft.DataFactory/factories/triggers/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Scheduler |
| source | <principal> |
| target | <ADF trigger (Scheduler or EventRule node)> |
| permissions | Microsoft.DataFactory/factories/triggers/write |
| conditions | role_compatibility |
| state logic | ACTIVE when the principal can write a trigger AND the pipeline the trigger fires has a managed identity (the trigger fires AS the MI — persistence). CONDITIONAL(role_compatibility) if the MI attachment is not yet confirmed. A trigger alone (without pipeline/write) only arms existing pipeline definitions — if the attacker also holds pipelines/write the full modify- then-run chain is ACTIVE. BLOCKED if a deny assignment covers triggers/write. |
Narrative
{principal.name} can create or modify a Schedule/Tumbling Window trigger for factory {target.name} (Microsoft.DataFactory/factories/triggers/write), establishing a persistent autonomous pipeline execution schedule that runs as the factory's managed identity.
Raw rule rules/derived/azure/datafactory.yaml
id: azure-adf-trigger-write-schedule
emits: CanSchedule
description: "Create or modify an ADF trigger (Schedule / Tumbling Window) to fire pipelines autonomously\
\ as the factory MI \u2014 persistent execution."
match_effective_permission:
action: Microsoft.DataFactory/factories/triggers/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Scheduler
source: <principal>
target: <ADF trigger (Scheduler or EventRule node)>
permissions:
- Microsoft.DataFactory/factories/triggers/write
conditions:
- role_compatibility
state_logic: "ACTIVE when the principal can write a trigger AND the pipeline the trigger fires has a\
\ managed identity (the trigger fires AS the MI \u2014 persistence). CONDITIONAL(role_compatibility)\
\ if the MI attachment is not yet confirmed. A trigger alone (without pipeline/write) only arms existing\
\ pipeline definitions \u2014 if the attacker also holds pipelines/write the full modify- then-run\
\ chain is ACTIVE. BLOCKED if a deny assignment covers triggers/write."
confidence: 0.88
derived_from:
- 'effective permission: Microsoft.DataFactory/factories/triggers/write'
false_positive_note: "triggers/write creates a RECURRING execution schedule; it is security-relevant\
\ only when the triggered pipeline runs as a managed identity. A Schedule trigger on a pipeline with\
\ no MI yields no ARM token access. The cicd-chains linchpin (cicd-modify-buildspec-executes-as) and\
\ can-execute-as (execute-as-via-code-modify) own the CanExecuteAs collapse when combined with CanModifyCode\
\ and ExecutesAs. This CanSchedule edge completes the CanTrigger path needed by those linchpins \u2014\
\ cite, do not re-derive CanExecuteAs here."
narrative: '{principal.name} can create or modify a Schedule/Tumbling Window trigger for factory {target.name}
(Microsoft.DataFactory/factories/triggers/write), establishing a persistent autonomous pipeline execution
schedule that runs as the factory''s managed identity.'