azure-devops-self-hosted-agent-executes-as

A self-hosted pipeline agent (VirtualMachine) runs as its OS user / managed identity, providing a second execution identity for all pipelines on that agent.

derived azure emits ExecutesAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`ContainerTask`
target type	`MachineIdentity`
source	`?agent_pool`
target	`OS user / managed identity of ?agent_vm`
conditions	`service_state`
state logic	ACTIVE when the agent pool is registered and enabled AND the agent VM's OS user / managed identity is available to the agent process (system-assigned MI accessible via IMDS, local OS user context active). CONDITIONAL(service_state) when the agent is offline or the VM is stopped. BLOCKED if the agent is deregistered or the VM is deleted.

source type

ContainerTask

target type

MachineIdentity

source

?agent_pool

target

OS user / managed identity of ?agent_vm

conditions

service_state

state logic

ACTIVE when the agent pool is registered and enabled AND the agent VM's OS user / managed identity is available to the agent process (system-assigned MI accessible via IMDS, local OS user context active). CONDITIONAL(service_state) when the agent is offline or the VM is stopped. BLOCKED if the agent is deregistered or the VM is deleted.

Narrative

{agent_pool.name} (self-hosted agent) runs on {agent_vm.name}; all pipeline jobs on this agent execute also as the VM's OS user or managed identity, providing a secondary execution context and access to the VM's credentials.

Raw rule rules/derived/azure/devops.yaml

id: azure-devops-self-hosted-agent-executes-as
emits: ExecutesAs
description: A self-hosted pipeline agent (VirtualMachine) runs as its OS user / managed identity, providing
  a second execution identity for all pipelines on that agent.
applies_to:
- azure
match:
- - agent_pool: null
  - LocatedIn
  - agent_vm: null
where:
- 'node_type(?agent_pool) == ContainerTask  # Agent pool node'
- node_type(?agent_vm) == VirtualMachine
- ?agent_pool.provider_type matches 'Microsoft.DevOps/agentpools'
- '?agent_pool.pool_type == ''self-hosted''  # Distinguishes from Microsoft-hosted pools'
emit:
  source_type: ContainerTask
  target_type: MachineIdentity
  source: ?agent_pool
  target: OS user / managed identity of ?agent_vm
  permissions: []
  conditions:
  - service_state
  state_logic: ACTIVE when the agent pool is registered and enabled AND the agent VM's OS user / managed
    identity is available to the agent process (system-assigned MI accessible via IMDS, local OS user
    context active). CONDITIONAL(service_state) when the agent is offline or the VM is stopped. BLOCKED
    if the agent is deregistered or the VM is deleted.
  confidence: 0.9
  derived_from: []
  false_positive_note: Only emit for self-hosted agent pools; Microsoft-hosted agents execute in Microsoft-
    managed infrastructure and do not expose a customer-controllable OS user identity. On Azure-hosted
    self-hosted VMs, the system-assigned managed identity is available via the IMDS endpoint; on on-premises
    self-hosted agents, the OS user context is the available identity. Do not emit if the agent VM is
    external (non-Azure) and has no managed identity.
  narrative: '{agent_pool.name} (self-hosted agent) runs on {agent_vm.name}; all pipeline jobs on this
    agent execute also as the VM''s OS user or managed identity, providing a secondary execution context
    and access to the VM''s credentials.'