azure-app-federated-cred-maps-to
match (record)
{
"field": "subject",
"resource_type": "microsoft.graph/applications/federatedIdentityCredentials"
}
emit
| source type | FederatedIdentity |
|---|---|
| target type | ApplicationIdentity |
| source | <ExternalIdentity / FederatedIdentity node for this issuer+subject> |
| target | <app registration / its service principal> |
Narrative
External identity with issuer {issuer} and subject '{subject}' maps to app registration {app.name} via the federatedIdentityCredential trust. When the trust condition is satisfied, this external identity can obtain {app.name}'s bearer token.
Raw rule rules/explicit/azure-managedidentity.yaml
id: azure-app-federated-cred-maps-to
emits: ExternalIdentityMapsTo
applies_to:
- azure
match_record:
resource_type: microsoft.graph/applications/federatedIdentityCredentials
field: subject
emit:
source_type: FederatedIdentity
target_type: ApplicationIdentity
source: <ExternalIdentity / FederatedIdentity node for this issuer+subject>
target: <app registration / its service principal>
api_source: az ad app federated-credential list
evidence_field: issuer, subject
note: Paired with azure-app-federated-cred-trust-anchor. Together these two explicit edges provide the
TrustsExternalIdentity + ExternalIdentityMapsTo pair that federation-chains.yaml (federation-maps-to-identity)
collapses into CanFederateAs(?ext -> ?app). ApplicationIdentity is a subtype of Identity, which is
in the ExternalIdentityMapsTo target set per edges.yaml, making this emit fully conformant. The cross-boundary
entry via federated SP is captured by hierarchy-chains enter-boundary-rollups when home_boundary differs.
narrative: External identity with issuer {issuer} and subject '{subject}' maps to app registration {app.name}
via the federatedIdentityCredential trust. When the trust condition is satisfied, this external identity
can obtain {app.name}'s bearer token.