rage.fail

azure-graph-app-role-grant

derived azure emits CanGrantPermission

match (effective permission)

{ "action": "appRoleAssignment / admin consent", "perm": "AppRoleAssignment.ReadWrite.All + Application.ReadWrite.All" }

emit

source type	`Identity`
target type	`Identity`
source	`<principal / service principal>`
target	`<service principal>`
permissions	`AppRoleAssignment.ReadWrite.All`

Narrative

{principal.name} can assign MS Graph app roles (AppRoleAssignment.ReadWrite.All) and grant itself directory-write, reaching tenant control.

Raw rule rules/derived/azure/identity-escalation.yaml

id: azure-graph-app-role-grant
emits: CanGrantPermission
match_effective_permission:
  action: appRoleAssignment / admin consent
  perm: AppRoleAssignment.ReadWrite.All + Application.ReadWrite.All
emit:
  source_type: Identity
  target_type: Identity
  source: <principal / service principal>
  target: <service principal>
  permissions:
  - AppRoleAssignment.ReadWrite.All
  escalation: Grant a controlled SP the RoleManagement.ReadWrite.Directory app role -> Global-Admin-equivalent.
  false_positive_note: 'This is the classic Graph privesc: AppRoleAssignment.ReadWrite.All lets an SP
    grant itself any app role. Flag high-impact.'
  narrative: '{principal.name} can assign MS Graph app roles (AppRoleAssignment.ReadWrite.All) and grant
    itself directory-write, reaching tenant control.'