azure-b2c-policy-admin-can-modify-config
B2C IEF Policy Administrator or Global Admin can upload/replace custom policy XML, effectively reconfiguring the entire authentication and federation pipeline.
match (effective permission)
{
"action": "Policy.ReadWrite.TrustFramework",
"api": "MS Graph PUT /beta/trustFramework/policies/{policyId}/$value"
}
where
principal holds 'B2C IEF Policy Administrator' or 'Global Administrator' directory role in the B2C tenant
emit
| source type | Identity |
|---|---|
| target type | TrustPolicy |
| source | <principal> |
| target | <B2C custom policy (TrustPolicy node)> |
| permissions | Policy.ReadWrite.TrustFramework |
| conditions | iam_permission |
| state logic | ACTIVE when directory role confirmed. CONDITIONAL if behind PIM activation. BLOCKED if a deny assignment or Conditional Access policy prevents Graph API access to the B2C tenant. |
Narrative
{principal.name} can upload custom policy XML to B2C tenant {tenant.name} (Policy.ReadWrite.TrustFramework via B2C IEF Policy Administrator or Global Admin), effectively reconfiguring the entire authentication pipeline - including which external identity providers are trusted - for all user flows implemented as custom policies.
Raw rule rules/derived/azure/b2c.yaml
id: azure-b2c-policy-admin-can-modify-config
emits: CanModifyConfiguration
description: B2C IEF Policy Administrator or Global Admin can upload/replace custom policy XML, effectively
reconfiguring the entire authentication and federation pipeline.
match_effective_permission:
action: Policy.ReadWrite.TrustFramework
api: MS Graph PUT /beta/trustFramework/policies/{policyId}/$value
where:
- principal holds 'B2C IEF Policy Administrator' or 'Global Administrator' directory role in the B2C tenant
emit:
source_type: Identity
target_type: TrustPolicy
source: <principal>
target: <B2C custom policy (TrustPolicy node)>
permissions:
- Policy.ReadWrite.TrustFramework
conditions:
- iam_permission
state_logic: ACTIVE when directory role confirmed. CONDITIONAL if behind PIM activation. BLOCKED if
a deny assignment or Conditional Access policy prevents Graph API access to the B2C tenant.
confidence: 0.85
derived_from:
- Azure B2C IEF Policy Administrator or Global Administrator directory role assignment
false_positive_note: ARM Contributor on the b2cDirectories ARM resource does NOT grant Policy.ReadWrite.TrustFramework
inside the B2C tenant. Only directory roles B2C IEF Policy Administrator and Global Administrator
in the B2C tenant authorize this action. Do not confuse the ARM subscription role with the B2C directory
role.
narrative: "{principal.name} can upload custom policy XML to B2C tenant {tenant.name} (Policy.ReadWrite.TrustFramework\
\ via B2C IEF Policy Administrator or Global Admin), effectively reconfiguring the entire authentication\
\ pipeline \u2014 including which external identity providers are trusted \u2014 for all user flows\
\ implemented as custom policies."