rage.fail

azure-dbx-workspace-contributor

explicit azure emits CanAdminister

match (effective permission)

{ "action": "Microsoft.Databricks/workspaces/write", "scope_type": "resource|resourceGroup|subscription" }

where

principal effectively holds Contributor, Owner, or a custom role granting Microsoft.Databricks/workspaces/* at the scope

emit

source type	`Identity`
target type	`*`
source	`<principal>`
target	`<Databricks workspace (Microsoft.Databricks/workspaces)>`
permissions	`Microsoft.Databricks/workspaces/write`

Narrative

{principal.name} has full ARM control of Databricks workspace {target.name} (Microsoft.Databricks/workspaces/write), enabling workspace reconfiguration and escalation via the Access Connector managed identity.

Raw rule rules/explicit/azure-databricks.yaml

id: azure-dbx-workspace-contributor
emits: CanAdminister
applies_to:
- azure
match_effective_permission:
  action: Microsoft.Databricks/workspaces/write
  scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Contributor, Owner, or a custom role granting Microsoft.Databricks/workspaces/*
  at the scope
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <Databricks workspace (Microsoft.Databricks/workspaces)>
  permissions:
  - Microsoft.Databricks/workspaces/write
  api_source: ARM role assignment
  evidence_field: roleAssignments[].properties.roleDefinitionId
  note: This is an explicit normalization rule that reads ARM role-assignment data to emit the CanAdminister
    capability. The match_effective_permission pattern evaluates the effective ARM RBAC permission directly
    from collected configuration.
  false_positive_note: workspaces/write grants ARM-level control of the workspace object and parameters;
    it does NOT grant Microsoft.Authorization/*/write (no self role-assignment). The escalation path is
    via the workspace's Access Connector MI, not direct role assignment. Databricks workspace Admin role
    (data-plane) is a separate grant.
  narrative: '{principal.name} has full ARM control of Databricks workspace {target.name} (Microsoft.Databricks/workspaces/write),
    enabling workspace reconfiguration and escalation via the Access Connector managed identity.'