rage.fail

azure-group-owner-add-member

derived azure emits CanAddMember

match (effective permission)

{ "action": "owner or member-write on group" }

where

group grants a privileged role/RBAC assignment group is role-assignable or has active assignments

emit

source type	`Identity`
source	`<principal>`
target	`<group>`
permissions	`microsoft.directory/groups/members/update OR group owner`

Narrative

{principal.name} can add members to group {group.name} which carries privileged access.

Raw rule rules/derived/azure/identity-escalation.yaml

id: azure-group-owner-add-member
emits: CanAddMember
match_effective_permission:
  action: owner or member-write on group
where:
- group grants a privileged role/RBAC assignment
- group is role-assignable or has active assignments
emit:
  source_type: Identity
  source: <principal>
  target: <group>
  permissions:
  - microsoft.directory/groups/members/update OR group owner
  escalation: Add self to a group that carries a privileged role.
  false_positive_note: Dynamic-membership groups cannot be joined by adding a member; check membershipRule
    instead.
  narrative: '{principal.name} can add members to group {group.name} which carries privileged access.'