azure-la-start
Enable a disabled Logic App workflow to realize CONDITIONAL execution edges.
match (effective permission)
{
"action": "Microsoft.Logic/workflows/enable/action",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Compute |
| source | <principal> |
| target | <Logic App workflow> |
| permissions | Microsoft.Logic/workflows/enable/action |
| state logic | ACTIVE when the effective permission is confirmed. Needed to realize any CONDITIONAL(service_state) execution edge on a Disabled workflow. Logic App Operator role includes enable/disable/action without workflows/write — this CanStart edge can exist without CanModifyCode. |
Narrative
{principal.name} can enable disabled Logic App {target.name} (Microsoft.Logic/workflows/enable/action), realizing any execution edges that are currently CONDITIONAL(service_state).
Raw rule rules/derived/azure/logicapps.yaml
id: azure-la-start
emits: CanStart
description: Enable a disabled Logic App workflow to realize CONDITIONAL execution edges.
match_effective_permission:
action: Microsoft.Logic/workflows/enable/action
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Compute
source: <principal>
target: <Logic App workflow>
permissions:
- Microsoft.Logic/workflows/enable/action
conditions: []
state_logic: "ACTIVE when the effective permission is confirmed. Needed to realize any CONDITIONAL(service_state)\
\ execution edge on a Disabled workflow. Logic App Operator role includes enable/disable/action without\
\ workflows/write \u2014 this CanStart edge can exist without CanModifyCode."
confidence: 0.98
derived_from:
- 'effective permission: Microsoft.Logic/workflows/enable/action'
false_positive_note: Logic App Operator (Microsoft.Logic/workflows/read + enable/disable + trigger/run)
grants enable/action without granting workflows/write. The CanStart capability is not escalation by
itself; it completes CONDITIONAL(service_state) edges (e.g., execution paths that require the workflow
to be Enabled). Do not derive CanModifyCode from Operator role.
narrative: '{principal.name} can enable disabled Logic App {target.name} (Microsoft.Logic/workflows/enable/action),
realizing any execution edges that are currently CONDITIONAL(service_state).'