azure-auto-account-write-identity

Modify the identity block of an Automation Account via automationAccounts/write; enables identity swap (CanAttachIdentity-like escalation).

derived azure emits CanModifyConfiguration

match (effective permission)

{ "action": "Microsoft.Automation/automationAccounts/write", "scope_type": "resource|resourceGroup|subscription" }

where

principal has EFFECTIVE automationAccounts/write (identity block modification is included in full write) account has no existing managed identity OR principal can also change the identity binding

emit

source typeIdentity
target typeGenericCompute
source<principal>
target<Automation Account (AutomationService)>
permissionsMicrosoft.Automation/automationAccounts/write
conditionsrole_compatibility
state logicACTIVE when the principal holds automationAccounts/write and can modify the identity block (full write includes identity mutation). CONDITIONAL(role_compatibility) if a specific MI assignment is checked (requires CanPassIdentity on that MI). BLOCKED if a deny assignment covers automationAccounts/write.

Narrative

{principal.name} can modify the identity configuration of Automation Account (automationAccounts/write); combined with CanPassIdentity on a target managed identity, this yields CanExecuteAs on the target identity.

Raw rule rules/derived/azure/automation.yaml

id: azure-auto-account-write-identity
emits: CanModifyConfiguration
description: Modify the identity block of an Automation Account via automationAccounts/write; enables
  identity swap (CanAttachIdentity-like escalation).
match_effective_permission:
  action: Microsoft.Automation/automationAccounts/write
  scope_type: resource|resourceGroup|subscription
where:
- principal has EFFECTIVE automationAccounts/write (identity block modification is included in full write)
- account has no existing managed identity OR principal can also change the identity binding
emit:
  source_type: Identity
  target_type: GenericCompute
  source: <principal>
  target: <Automation Account (AutomationService)>
  permissions:
  - Microsoft.Automation/automationAccounts/write
  conditions:
  - role_compatibility
  state_logic: ACTIVE when the principal holds automationAccounts/write and can modify the identity block
    (full write includes identity mutation). CONDITIONAL(role_compatibility) if a specific MI assignment
    is checked (requires CanPassIdentity on that MI). BLOCKED if a deny assignment covers automationAccounts/write.
  confidence: 0.92
  derived_from:
  - 'effective permission: Microsoft.Automation/automationAccounts/write'
  - 'can-execute-as.yaml: execute-as-via-config-identity-swap (CanModifyConfiguration + CanPassIdentity
    => CanExecuteAs)'
  false_positive_note: automationAccounts/write includes identity block changes (systemAssignedIdentity,
    userAssignedIdentities). Confirm the principal holds the full write action, not a narrower delegated
    MI-assignment-only permission. Pairing with CanPassIdentity on a target MI yields CanExecuteAs via
    can-execute-as execute-as-via-config-identity-swap.
  narrative: '{principal.name} can modify the identity configuration of Automation Account (automationAccounts/write);
    combined with CanPassIdentity on a target managed identity, this yields CanExecuteAs on the target
    identity.'
move · open · esc close