azure-lighthouse-cross-tenant-trust-explicit

id: azure-lighthouse-cross-tenant-trust-explicit
emits: CrossTenantTrust
applies_to:
- azure
match_record:
  resource_type: Microsoft.ManagedServices/registrationAssignments
  field: properties.registrationDefinition.properties.managingTenantId
where:
- properties.provisioningState == 'Succeeded'
- properties.registrationDefinition.properties.authorizations is non-empty
- none of properties.registrationDefinition.properties.authorizations[].roleDefinitionId == '8e3af657-a8ff-443c-a75c-2fe8c4bcb635'
emit:
  source_type: Tenant
  target_type: Tenant
  source: <Tenant node for properties.registrationDefinition.properties.managingTenantId>
  target: <Tenant node for the customer subscription's tenantId>
  api_source: GET /subscriptions/{subId}/providers/Microsoft.ManagedServices/registrationAssignments?$expand=registrationDefinition
  evidence_field: properties.registrationDefinition.properties.managingTenantId
  note: "CrossTenantTrust schema source=[Tenant, ApplicationIdentity]; target=[Tenant, ExternalIdentity].\
    \ Source: managing Tenant node (construct from managingTenantId). Target: customer Tenant node (from\
    \ subscription's tenantId property). NOT the Subscription node \u2014 Subscription is not in the schema\
    \ source/target sets. Dedupe on (CrossTenantTrust, managingTenantId, customerTenantId): if multiple\
    \ registrationAssignments share the same managing tenant, emit once per (managing-tenant, customer-tenant)\
    \ pair."
  narrative: Managing tenant {managingTenantId} has a Lighthouse delegation active in customer tenant
    {customerTenantId} via registrationAssignment {assignment.name}.