rage.fail

azure-app-sp-ownership

derived azure emits CanTakeOwnership

match (effective permission)

{ "action": "owner of application/servicePrincipal" }

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<application/servicePrincipal>`
permissions	`microsoft.directory/applications/owners OR servicePrincipals/owners`

Narrative

{principal.name} owns {app.name} and can therefore add credentials and act as it.

Raw rule rules/derived/azure/identity-escalation.yaml

id: azure-app-sp-ownership
emits: CanTakeOwnership
match_effective_permission:
  action: owner of application/servicePrincipal
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <application/servicePrincipal>
  permissions:
  - microsoft.directory/applications/owners OR servicePrincipals/owners
  note: Ownership -> ability to add credentials -> CanCreateCredentialFor (chained).
  narrative: '{principal.name} owns {app.name} and can therefore add credentials and act as it.'