rage.fail

azure-directory-role-assign

derived azure emits CanGrantPermission

match (effective permission)

{ "action": "microsoft.directory/roleAssignments/create OR RoleManagement.ReadWrite.Directory" }

where

principal holds Privileged Role Administrator or Global Administrator

emit

source type	`Identity`
target type	`Identity`
source	`<principal>`
target	`<tenant>`
permissions	`Privileged Role Administrator` `RoleManagement.ReadWrite.Directory`

Narrative

{principal.name} can assign Entra directory roles (Privileged Role Admin) and self-grant Global Administrator.

Raw rule rules/derived/azure/identity-escalation.yaml

id: azure-directory-role-assign
emits: CanGrantPermission
match_effective_permission:
  action: microsoft.directory/roleAssignments/create OR RoleManagement.ReadWrite.Directory
where:
- principal holds Privileged Role Administrator or Global Administrator
emit:
  source_type: Identity
  target_type: Identity
  source: <principal>
  target: <tenant>
  permissions:
  - Privileged Role Administrator
  - RoleManagement.ReadWrite.Directory
  escalation: Grant self Global Administrator -> tenant takeover.
  cross_boundary: emits Controls(tenant) / CanEnterTenant
  narrative: '{principal.name} can assign Entra directory roles (Privileged Role Admin) and self-grant
    Global Administrator.'