azure-aml-workspace-admin
Full ARM control of the AML workspace grants administrative authority over all compute, jobs, datastores, and linked services.
match (effective permission)
{
"action": "Microsoft.MachineLearningServices/workspaces/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Contributor / Owner / AzureML Workspace Admin (or a custom role granting Microsoft.MachineLearningServices/workspaces/*) at the scope
emit
| source type | Identity |
|---|---|
| target type | AnalyticsService |
| source | <principal> |
| target | <AML workspace> |
| permissions | Microsoft.MachineLearningServices/workspaces/write |
Narrative
{principal.name} has full control of AML workspace {target.name} (workspaces/write), including compute, jobs, datastores, and linked services.
Raw rule rules/explicit/azure-machinelearning.yaml
id: azure-aml-workspace-admin
emits: CanAdminister
applies_to:
- azure
description: Full ARM control of the AML workspace grants administrative authority over all compute, jobs,
datastores, and linked services.
match_effective_permission:
action: Microsoft.MachineLearningServices/workspaces/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Contributor / Owner / AzureML Workspace Admin (or a custom role granting
Microsoft.MachineLearningServices/workspaces/*) at the scope
emit:
source_type: Identity
target_type: AnalyticsService
source: <principal>
target: <AML workspace>
permissions:
- Microsoft.MachineLearningServices/workspaces/write
api_source: role assignment evaluation
evidence_field: roleAssignments.properties.roleDefinitionId
false_positive_note: workspaces/write grants ARM-level control of workspace configuration and linked
services but NOT Microsoft.Authorization/*/write; escalation is via the workspace or compute MI, not
self-role-assignment. Sufficient for all downstream code-execution paths.
narrative: '{principal.name} has full control of AML workspace {target.name} (workspaces/write), including
compute, jobs, datastores, and linked services.'