azure-la-recurrence-schedule

A Logic App with a Recurrence trigger fires autonomously on a cadence - creating/modifying it with workflows/write is schedule creation.

derived azure emits CanSchedule

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Workflow`
source	`<principal>`
target	`<Logic App workflow (as a Scheduler/schedule target)>`
permissions	`Microsoft.Logic/workflows/write`
conditions	`role_compatibility` `iam_permission`
state logic	ACTIVE when the principal can write the definition AND the workflow has a managed identity (the schedule fires AS the MI — persistence). CONDITIONAL (role_compatibility) if the MI attachment is not yet confirmed. messaging-chains messaging-schedule-persists-executes-as (rule 3) fires on this CanSchedule + CanPassIdentity to produce CanExecuteAs(principal -> MI); cite, do not re-derive.

source type

Identity

target type

Workflow

source

<principal>

target

<Logic App workflow (as a Scheduler/schedule target)>

permissions

Microsoft.Logic/workflows/write

conditions

role_compatibility iam_permission

state logic

ACTIVE when the principal can write the definition AND the workflow has a managed identity (the schedule fires AS the MI — persistence). CONDITIONAL (role_compatibility) if the MI attachment is not yet confirmed. messaging-chains messaging-schedule-persists-executes-as (rule 3) fires on this CanSchedule + CanPassIdentity to produce CanExecuteAs(principal -> MI); cite, do not re-derive.

Narrative

{principal.name} can write a Recurrence trigger into the definition of Logic App {target.name} (Microsoft.Logic/workflows/write), creating a persistent schedule that fires the workflow autonomously as its managed identity.

Raw rule rules/derived/azure/logicapps.yaml

id: azure-la-recurrence-schedule
emits: CanSchedule
description: "A Logic App with a Recurrence trigger fires autonomously on a cadence \u2014 creating/modifying\
  \ it with workflows/write is schedule creation."
match:
- - principal: null
  - CanModifyCode
  - workflow: null
where:
- node_type(?workflow) == Workflow
- ?principal can set a Recurrence trigger in the workflow definition via Microsoft.Logic/workflows/write
emit:
  source_type: Identity
  target_type: Workflow
  source: <principal>
  target: <Logic App workflow (as a Scheduler/schedule target)>
  permissions:
  - Microsoft.Logic/workflows/write
  conditions:
  - role_compatibility
  - iam_permission
  state_logic: "ACTIVE when the principal can write the definition AND the workflow has a managed identity\
    \ (the schedule fires AS the MI \u2014 persistence). CONDITIONAL (role_compatibility) if the MI attachment\
    \ is not yet confirmed. messaging-chains messaging-schedule-persists-executes-as (rule 3) fires on\
    \ this CanSchedule + CanPassIdentity to produce CanExecuteAs(principal -> MI); cite, do not re-derive."
  confidence: 0.88
  derived_from:
  - '<CanModifyCode edge: ?principal -> ?workflow (from azure-la-workflow-write-modifycode)>'
  false_positive_note: "This CanSchedule edge represents the CREATION of a recurring execution schedule\
    \ (the Recurrence trigger). It is only security-relevant when the workflow has a managed identity\
    \ \u2014 a recurrence-triggered workflow with no MI and no downstream credential access is low value.\
    \ Requires CanPassIdentity on the MI (workflows/write alone enables system-assigned MI but yields\
    \ no RBAC; user-assigned MI requires assign/action). messaging-chains rule 3 owns the CanSchedule\
    \ + CanPassIdentity => CanExecuteAs collapse \u2014 cite, do not re-derive here."
  narrative: '{principal.name} can write a Recurrence trigger into the definition of Logic App {target.name}
    (Microsoft.Logic/workflows/write), creating a persistent schedule that fires the workflow autonomously
    as its managed identity.'