azure-auto-account-write-identity
Modify the identity block of an Automation Account via automationAccounts/write; enables identity swap (CanAttachIdentity-like escalation).
match (effective permission)
{
"action": "Microsoft.Automation/automationAccounts/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal has EFFECTIVE automationAccounts/write (identity block modification is included in full write)
account has no existing managed identity OR principal can also change the identity binding
emit
| source type | Identity |
|---|---|
| target type | GenericCompute |
| source | <principal> |
| target | <Automation Account (AutomationService)> |
| permissions | Microsoft.Automation/automationAccounts/write |
| conditions | role_compatibility |
| state logic | ACTIVE when the principal holds automationAccounts/write and can modify the identity block (full write includes identity mutation). CONDITIONAL(role_compatibility) if a specific MI assignment is checked (requires CanPassIdentity on that MI). BLOCKED if a deny assignment covers automationAccounts/write. |
Narrative
{principal.name} can modify the identity configuration of Automation Account (automationAccounts/write); combined with CanPassIdentity on a target managed identity, this yields CanExecuteAs on the target identity.
Raw rule rules/derived/azure/automation.yaml
id: azure-auto-account-write-identity
emits: CanModifyConfiguration
description: Modify the identity block of an Automation Account via automationAccounts/write; enables
identity swap (CanAttachIdentity-like escalation).
match_effective_permission:
action: Microsoft.Automation/automationAccounts/write
scope_type: resource|resourceGroup|subscription
where:
- principal has EFFECTIVE automationAccounts/write (identity block modification is included in full write)
- account has no existing managed identity OR principal can also change the identity binding
emit:
source_type: Identity
target_type: GenericCompute
source: <principal>
target: <Automation Account (AutomationService)>
permissions:
- Microsoft.Automation/automationAccounts/write
conditions:
- role_compatibility
state_logic: ACTIVE when the principal holds automationAccounts/write and can modify the identity block
(full write includes identity mutation). CONDITIONAL(role_compatibility) if a specific MI assignment
is checked (requires CanPassIdentity on that MI). BLOCKED if a deny assignment covers automationAccounts/write.
confidence: 0.92
derived_from:
- 'effective permission: Microsoft.Automation/automationAccounts/write'
- 'can-execute-as.yaml: execute-as-via-config-identity-swap (CanModifyConfiguration + CanPassIdentity
=> CanExecuteAs)'
false_positive_note: automationAccounts/write includes identity block changes (systemAssignedIdentity,
userAssignedIdentities). Confirm the principal holds the full write action, not a narrower delegated
MI-assignment-only permission. Pairing with CanPassIdentity on a target MI yields CanExecuteAs via
can-execute-as execute-as-via-config-identity-swap.
narrative: '{principal.name} can modify the identity configuration of Automation Account (automationAccounts/write);
combined with CanPassIdentity on a target managed identity, this yields CanExecuteAs on the target
identity.'