azure-evg-partner-config-modify
Modifying Event Grid partner configurations authorizes an external partner to publish events into this subscription; a capability to alter subscription-level messaging trust.
match (effective permission)
{
"action": "Microsoft.EventGrid/partnerConfigurations/write",
"scope_type": "subscription"
}
where
the subscription scope includes the subscription being configured
emit
| source type | Identity |
|---|---|
| target type | AdministrativeBoundary |
| source | <principal holding partnerConfigurations/write> |
| target | <subscription (AdministrativeBoundary)> |
| permissions | Microsoft.EventGrid/partnerConfigurations/write |
| state logic | ACTIVE when partnerConfigurations/write is confirmed at subscription scope. The capability allows the principal to authorize external partner namespaces to publish into this subscription's partner topics. BLOCKED if a deny assignment covers partnerConfigurations/write. |
Narrative
{principal.name} holds Microsoft.EventGrid/partnerConfigurations/write at subscription scope; it can authorize external partner registrations to publish events into partner topics in this subscription.
Raw rule rules/derived/azure/eventgrid.yaml
id: azure-evg-partner-config-modify
emits: CanModifyConfiguration
description: Modifying Event Grid partner configurations authorizes an external partner to publish events
into this subscription; a capability to alter subscription-level messaging trust.
match_effective_permission:
action: Microsoft.EventGrid/partnerConfigurations/write
scope_type: subscription
where:
- the subscription scope includes the subscription being configured
emit:
source_type: Identity
target_type: AdministrativeBoundary
source: <principal holding partnerConfigurations/write>
target: <subscription (AdministrativeBoundary)>
permissions:
- Microsoft.EventGrid/partnerConfigurations/write
conditions: []
state_logic: ACTIVE when partnerConfigurations/write is confirmed at subscription scope. The capability
allows the principal to authorize external partner namespaces to publish into this subscription's
partner topics. BLOCKED if a deny assignment covers partnerConfigurations/write.
confidence: 0.9
derived_from:
- 'effective permission: Microsoft.EventGrid/partnerConfigurations/write at subscription scope'
- 'messaging-chains.yaml: messaging-resource-policy-cross-boundary-trust (rule 4) cites cross-boundary
messaging trust patterns'
false_positive_note: 'partnerConfigurations/write grants control over which external partners are authorized
to publish into this subscription via partner topics. Event Grid partner namespaces require Microsoft
verification; preview/self-registered namespaces also exist. The cross-tenant TRUST structure itself
(source: customer Tenant, target: partner Tenant) is modeled as an explicit edge in azure-eventgrid.yaml
when the partner topic is Activated. This rule captures the configuration capability; can-control
rolls up to CanEnterSubscription if a live consumer fires. Cite, do not re-derive the CanEnter* roll-up.'
narrative: '{principal.name} holds Microsoft.EventGrid/partnerConfigurations/write at subscription scope;
it can authorize external partner registrations to publish events into partner topics in this subscription.'