rage.fail

azure-federated-credential-write

derived azure emits CanModifyTrust

match (effective permission)

{ "action": "add federatedIdentityCredential to app/MI", "api": "MS Graph applications/{id}/federatedIdentityCredentials" }

emit

source type	`Identity`
source	`<principal>`
target	`<application / managed identity>`
permissions	`microsoft.directory/applications/credentials/update`

Narrative

{principal.name} can add a federated identity credential to {app.name}, trusting an external issuer it controls.

Raw rule rules/derived/azure/identity-escalation.yaml

id: azure-federated-credential-write
emits: CanModifyTrust
match_effective_permission:
  action: add federatedIdentityCredential to app/MI
  api: MS Graph applications/{id}/federatedIdentityCredentials
emit:
  source_type: Identity
  source: <principal>
  target: <application / managed identity>
  permissions:
  - microsoft.directory/applications/credentials/update
  escalation: Add a federated credential trusting an attacker-controlled OIDC issuer -> token as the app
    without a secret.
  narrative: '{principal.name} can add a federated identity credential to {app.name}, trusting an external
    issuer it controls.'