azure-la-connection-cross-tenant

An API connection referencing a resource in a different Entra tenant represents cross-tenant credential trust.

derived azure emits CrossTenantTrust

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`ApplicationIdentity`
target type	`Tenant`
source	`<API connection resource (modeled as the ApplicationIdentity backing the Entra app registration used by the connection)>`
target	`<Entra tenant of the backend resource>`
conditions	`resource_policy` `condition_expression`
state logic	ACTIVE when the connection is confirmed to authenticate to a resource in a DIFFERENT Entra tenant and the stored credential has not expired. CONDITIONAL(condition_expression) when the connection uses a managed identity (cross-tenant MI: only possible with user-assigned MI configured for cross-tenant federation). BLOCKED if a deny assignment prevents the connection from being used.

source type

ApplicationIdentity

target type

Tenant

source

<API connection resource (modeled as the ApplicationIdentity backing the Entra app registration used by the connection)>

target

<Entra tenant of the backend resource>

conditions

resource_policy condition_expression

state logic

ACTIVE when the connection is confirmed to authenticate to a resource in a DIFFERENT Entra tenant and the stored credential has not expired. CONDITIONAL(condition_expression) when the connection uses a managed identity (cross-tenant MI: only possible with user-assigned MI configured for cross-tenant federation). BLOCKED if a deny assignment prevents the connection from being used.

Narrative

API connection {connection.name} stores a credential authenticating to a resource in a different Entra tenant; access to this connection key crosses the tenant boundary (can-control rolls up to CanEnterTenant).

Raw rule rules/derived/azure/logicapps.yaml

id: azure-la-connection-cross-tenant
emits: CrossTenantTrust
description: An API connection referencing a resource in a different Entra tenant represents cross-tenant
  credential trust.
match:
- - connection: null
  - ContainsSecret
  - cred: null
where:
- ?connection is a Microsoft.Web/connections resource (node_class == Messaging)
- the backend resource the connection authenticates to is in a DIFFERENT Entra tenant than the Logic App
- backend_tenant != logic_app_tenant
emit:
  source_type: ApplicationIdentity
  target_type: Tenant
  source: <API connection resource (modeled as the ApplicationIdentity backing the Entra app registration
    used by the connection)>
  target: <Entra tenant of the backend resource>
  permissions: []
  conditions:
  - resource_policy
  - condition_expression
  state_logic: 'ACTIVE when the connection is confirmed to authenticate to a resource in a DIFFERENT Entra
    tenant and the stored credential has not expired. CONDITIONAL(condition_expression) when the connection
    uses a managed identity (cross-tenant MI: only possible with user-assigned MI configured for cross-tenant
    federation). BLOCKED if a deny assignment prevents the connection from being used.'
  confidence: 0.75
  derived_from:
  - '<ContainsSecret edge: ?connection -> ?cred>'
  false_positive_note: "This rule emits only for CROSS-TENANT connections (backend in a different Entra\
    \ tenant). Same-tenant cross-subscription connections do NOT emit CrossTenantTrust \u2014 see azure-la-connection-cross-subscription.\
    \ The edge asserts only the TRUST (the credential spans the tenant boundary) \u2014 the CanEnterTenant\
    \ consequence is can-control's responsibility; do NOT re-derive CanEnterTenant here. For cross-tenant\
    \ connections via OAuth (rare), the token is scoped to the specific resource \u2014 downgrade to CONDITIONAL\
    \ if the OAuth scope is narrow."
  narrative: API connection {connection.name} stores a credential authenticating to a resource in a different
    Entra tenant; access to this connection key crosses the tenant boundary (can-control rolls up to CanEnterTenant).