azure-cognitivesearch-rbac-data-read

A principal with Search Index Data Reader or Search Index Data Contributor RBAC (Entra role) can query the search service indexes via Entra-authenticated access, without requiring API keys. This path bypasses the disableLocalAuth gate and credential extraction entirely.

derived azure emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'service': None}

where

node_class(?service) == Data and node_type(?service) == SearchService ?service.provider_type == 'Microsoft.Search/searchServices' ?principal has EFFECTIVE Microsoft.Search/searchServices/indexes/docs/search/action OR Microsoft.Search/searchServices/indexes/docs/*/action at ?service scope (granted by Search Index Data Reader 1407120a-92aa-4202-b7e9-c0e197c71c8f or Search Index Data Contributor 8ebe5a00-799e-43f5-93ac-243d3dce84a7)

emit

source type	`Identity`
target type	`Data`
source	`?principal`
target	`<all indexes (Data nodes) within ?service>`
permissions	`Microsoft.Search/searchServices/indexes/docs/search/action` `Microsoft.Search/searchServices/indexes/docs/*/action`
conditions	`iam_permission` `network_reachability`
state logic	ACTIVE when ?principal has effective indexes/docs/search/action (or wildcard) AND the search service data-plane endpoint is network-reachable (publicNetworkAccess not Disabled, OR principal has network access via private endpoint). CONDITIONAL(network_reachability) when publicNetworkAccess is Disabled — Entra-authenticated queries require network reach to the data-plane endpoint (https://<service>.search.windows.net). BLOCKED if a deny assignment covers the action at the effective scope. No disableLocalAuth gate applies — RBAC paths bypass key-based auth entirely.

Narrative

{principal.name} holds Microsoft.Search/searchServices/indexes/docs/search/action on search service {service.name} (via Search Index Data Reader or Contributor role) and can query all indexes using Entra-authenticated access (no API key required). This bypasses any key-based access controls and allows reading the full content of all indexed documents. Indexed documents may contain PII, sensitive business data, secrets, or other high-value information ingested from connected data sources.

Raw rule rules/derived/azure/cognitivesearch.yaml

id: azure-cognitivesearch-rbac-data-read
emits: CanReadData
description: A principal with Search Index Data Reader or Search Index Data Contributor RBAC (Entra role)
  can query the search service indexes via Entra-authenticated access, without requiring API keys. This
  path bypasses the disableLocalAuth gate and credential extraction entirely.
match:
- - principal: null
  - HasPermission
  - service: null
where:
- node_class(?service) == Data and node_type(?service) == SearchService
- ?service.provider_type == 'Microsoft.Search/searchServices'
- ?principal has EFFECTIVE Microsoft.Search/searchServices/indexes/docs/search/action OR Microsoft.Search/searchServices/indexes/docs/*/action
  at ?service scope (granted by Search Index Data Reader 1407120a-92aa-4202-b7e9-c0e197c71c8f or Search
  Index Data Contributor 8ebe5a00-799e-43f5-93ac-243d3dce84a7)
emit:
  source_type: Identity
  target_type: Data
  source: ?principal
  target: <all indexes (Data nodes) within ?service>
  permissions:
  - Microsoft.Search/searchServices/indexes/docs/search/action
  - Microsoft.Search/searchServices/indexes/docs/*/action
  conditions:
  - iam_permission
  - network_reachability
  state_logic: "ACTIVE when ?principal has effective indexes/docs/search/action (or wildcard) AND the\
    \ search service data-plane endpoint is network-reachable (publicNetworkAccess not Disabled, OR principal\
    \ has network access via private endpoint). CONDITIONAL(network_reachability) when publicNetworkAccess\
    \ is Disabled \u2014 Entra-authenticated queries require network reach to the data-plane endpoint\
    \ (https://<service>.search.windows.net). BLOCKED if a deny assignment covers the action at the effective\
    \ scope. No disableLocalAuth gate applies \u2014 RBAC paths bypass key-based auth entirely."
  confidence: 0.87
  derived_from:
  - 'RBAC effective permission: Microsoft.Search/searchServices/indexes/docs/search/action (or wildcard)'
  - Granted by Search Index Data Reader or Search Index Data Contributor built-in role
  - ?service.properties.publicNetworkAccess
  false_positive_note: "This path does NOT depend on disableLocalAuth \u2014 Entra RBAC authentication\
    \ operates independently of key-based auth settings. Do not emit if disableLocalAuth is the only gate;\
    \ network reachability is the primary condition. Search Index Data Reader is read-only (search/suggest/autocomplete);\
    \ Search Index Data Contributor allows both read and write \u2014 but both yield CanReadData for the\
    \ attack path. Do not conflate with admin-key holders, which have full service control."
  narrative: '{principal.name} holds Microsoft.Search/searchServices/indexes/docs/search/action on search
    service {service.name} (via Search Index Data Reader or Contributor role) and can query all indexes
    using Entra-authenticated access (no API key required). This bypasses any key-based access controls
    and allows reading the full content of all indexed documents. Indexed documents may contain PII, sensitive
    business data, secrets, or other high-value information ingested from connected data sources.'