azure-la-callback-url

id: azure-la-callback-url
emits: CanReadSecret
description: Obtain the SAS-signed HTTP trigger callback URL for a Logic App (listCallbackUrl/action).
match_effective_permission:
  action: Microsoft.Logic/workflows/triggers/*/listCallbackUrl/action
  scope_type: resource|resourceGroup|subscription
emit:
  source_type: Identity
  target_type: '*'
  source: <principal>
  target: <HTTP trigger callback URL (APIKey node)>
  permissions:
  - Microsoft.Logic/workflows/triggers/*/listCallbackUrl/action
  conditions: []
  state_logic: ACTIVE when the effective permission is confirmed and the workflow has an HTTP (Request)
    trigger. CONDITIONAL if the workflow access key has been recently regenerated (listCallbackUrl returns
    the NEW URL; old URLs are immediately invalid after regenerate/action). BLOCKED if a deny assignment
    covers the listCallbackUrl action.
  confidence: 0.95
  derived_from:
  - 'effective permission: Microsoft.Logic/workflows/triggers/listCallbackUrl/action'
  false_positive_note: "The callback URL contains a SAS signature tied to the workflow's access key. If\
    \ the access key is regenerated (accessKeys/regenerate/action), all existing SAS URLs are immediately\
    \ invalidated \u2014 a known rotation control. Downgrade to POTENTIAL if key rotation is confirmed\
    \ recent or automatic. The URL is valid only for the specific trigger it was issued for; do not assume\
    \ it covers all triggers. This CanReadSecret feeds CanInvoke(callback-URL holder -> workflow) via\
    \ rule azure-la-http-trigger-invoke; the credential-chains roll-up then connects to CanExecuteAs if\
    \ the workflow has a MI."
  narrative: '{principal.name} can obtain the SAS-signed HTTP callback URL of Logic App {target.name}
    trigger (listCallbackUrl/action); possession of the URL allows triggering the workflow without Entra
    authentication.'