azure-adls-generateuserdelegationkey-credential

generateUserDelegationKey/action allows minting user-delegation SAS tokens (Token credential type) for external distribution.

derived azure emits CanReadCredential

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

emit

source type	`Identity`
target type	`Token`
source	`?principal`
target	`<user-delegation SAS Token derived from ?account>`
permissions	`Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action`
conditions	`iam_permission` `network_reachability`
state logic	if networkAcls.defaultAction == Deny AND ?principal not in IP/VNet allowlist AND no private endpoint path: CONDITIONAL(network_reachability); elif a deny assignment or deny Azure Policy covers generateUserDelegationKey: BLOCKED; else ACTIVE (capable of minting user-delegation SAS tokens scoped to caller's identity).

source type

Identity

target type

Token

source

?principal

target

<user-delegation SAS Token derived from ?account>

permissions

Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action

conditions

iam_permission network_reachability

state logic

if networkAcls.defaultAction == Deny AND ?principal not in IP/VNet allowlist AND no private endpoint path: CONDITIONAL(network_reachability); elif a deny assignment or deny Azure Policy covers generateUserDelegationKey: BLOCKED; else ACTIVE (capable of minting user-delegation SAS tokens scoped to caller's identity).

Raw rule rules/derived/azure/adls.yaml

id: azure-adls-generateuserdelegationkey-credential
emits: CanReadCredential
description: generateUserDelegationKey/action allows minting user-delegation SAS tokens (Token credential
  type) for external distribution.
match:
- - principal: null
  - HasPermission
  - account: null
where:
- node_class(?account) == Data and node_type(?account) == DataLake
- ?account.properties.isHnsEnabled == true
- ?principal has EFFECTIVE Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action
  at ?account or container scope
emit:
  source_type: Identity
  target_type: Token
  source: ?principal
  target: <user-delegation SAS Token derived from ?account>
  permissions:
  - Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action
  conditions:
  - iam_permission
  - network_reachability
  state_logic: 'if networkAcls.defaultAction == Deny AND ?principal not in IP/VNet allowlist AND no private
    endpoint path: CONDITIONAL(network_reachability); elif a deny assignment or deny Azure Policy covers
    generateUserDelegationKey: BLOCKED; else ACTIVE (capable of minting user-delegation SAS tokens scoped
    to caller''s identity).'
  confidence: '0.85'
  derived_from:
  - <HasPermission edge_id (generateUserDelegationKey/action)>
  false_positive_note: "This is a narrower-scope credential minting compared to account-key listKeys.\
    \ User-delegation SAS tokens are scoped to the caller's own Entra identity's permissions, not the\
    \ account key (no storage-service-level bypass). However, the tokens are distributable to external\
    \ parties and do not require Entra auth at the destination \u2014 enabling persistent cross-tenant\
    \ access delegation. Network reachability gates the data-plane endpoint where the key is generated.\
    \ Unlike CanReadCredential on AccessKey (listKeys), these tokens have caller-bounded permissions."