azure-aml-batch-endpoint-trigger
Principal can invoke a batch endpoint to trigger a batch scoring job on the endpoint's compute cluster.
match (effective permission)
{
"action": "Microsoft.MachineLearningServices/workspaces/batchEndpoints/jobs/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | BatchJob |
| source | <principal> |
| target | <batch endpoint compute cluster> |
| permissions | Microsoft.MachineLearningServices/workspaces/batchEndpoints/jobs/write |
Narrative
{principal.name} can trigger batch scoring jobs (batchEndpoints/jobs/write); escalation depends on whether the scoring script runs attacker-influenced code.
Raw rule rules/explicit/azure-machinelearning.yaml
id: azure-aml-batch-endpoint-trigger
emits: CanTrigger
applies_to:
- azure
description: Principal can invoke a batch endpoint to trigger a batch scoring job on the endpoint's compute
cluster.
match_effective_permission:
action: Microsoft.MachineLearningServices/workspaces/batchEndpoints/jobs/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: BatchJob
source: <principal>
target: <batch endpoint compute cluster>
permissions:
- Microsoft.MachineLearningServices/workspaces/batchEndpoints/jobs/write
api_source: role assignment evaluation
evidence_field: roleAssignments.properties.roleDefinitionId
note: Triggering a batch endpoint runs the existing deployment scoring code. Escalation to the cluster
MI requires the current scoring code to be attacker-influenced.
false_positive_note: Batch endpoint invoke with a clean, trusted scoring script is trigger-only; it
does not grant code control.
narrative: '{principal.name} can trigger batch scoring jobs (batchEndpoints/jobs/write); escalation
depends on whether the scoring script runs attacker-influenced code.'