rage.fail

azure-app-add-credential

derived azure emits CanCreateCredentialFor

match (effective permission)

{ "action": "add password/certificate to application", "api": "MS Graph applications/{id}/addPassword" }

where

principal is an OWNER of the app registration OR holds Application.ReadWrite.All / Application Administrator

emit

source type	`Identity`
source	`<principal>`
target	`<application registration>`
permissions	`microsoft.directory/applications/credentials/update` `Application.ReadWrite.All`

Narrative

{principal.name} can add credentials to app registration {app.name} and authenticate as its service principal.

Raw rule rules/derived/azure/identity-escalation.yaml

id: azure-app-add-credential
emits: CanCreateCredentialFor
match_effective_permission:
  action: add password/certificate to application
  api: MS Graph applications/{id}/addPassword
where:
- principal is an OWNER of the app registration OR holds Application.ReadWrite.All / Application Administrator
emit:
  source_type: Identity
  source: <principal>
  target: <application registration>
  permissions:
  - microsoft.directory/applications/credentials/update
  - Application.ReadWrite.All
  escalation: Add a secret to a high-privilege app registration and obtain its tokens.
  narrative: '{principal.name} can add credentials to app registration {app.name} and authenticate as
    its service principal.'