azure-lighthouse-definition-modify-trust

A customer principal with Microsoft.ManagedServices/registrationDefinitions/write can modify Lighthouse trust anchors (authorizations list, managing tenant).

derived azure emits CanModifyTrust

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'customer_principal': None} HasPermission {'customer_sub': None}

where

node_class(?customer_sub) == AdministrativeBoundary and node_type(?customer_sub) in [Subscription, ResourceGroup] ?customer_principal holds EFFECTIVE Microsoft.ManagedServices/registrationDefinitions/write at ?customer_sub scope ?customer_principal holds this via Owner role ('*' actions) or a custom role explicitly granting this action

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

{'customer_sub': None} HasPolicy {'reg_definition': None}

emit

source type	`Identity`
target type	`TrustPolicy`
source	`?customer_principal`
target	`<registrationDefinition TrustPolicy node in ?customer_sub>`
permissions	`Microsoft.ManagedServices/registrationDefinitions/write`
conditions	`iam_permission` `deny_assignment`
state logic	ACTIVE when ?customer_principal holds the write action unconditionally at the scope. CONDITIONAL(iam_permission) when the role assignment carries an ABAC condition or the principal has only an eligible (PIM) assignment for the Owner role. BLOCKED when a deny assignment (ConditionalPolicy) or deny-effect Azure Policy (OrganizationPolicy) at the scope or an ancestor explicitly denies Microsoft.ManagedServices/registrationDefinitions/write. Only Owner ('*' actions) and custom roles explicitly granting this action qualify; Contributor does NOT.

Narrative

{customer_principal.name} holds Owner (or a custom ManagedServices-write role) at {customer_sub.name} and can create or modify Lighthouse registrationDefinitions - enabling them to widen the trust authorization list or change the managing tenant entirely, directing future access to a malicious tenant.

Raw rule rules/derived/azure/lighthouse.yaml

id: azure-lighthouse-definition-modify-trust
emits: CanModifyTrust
description: A customer principal with Microsoft.ManagedServices/registrationDefinitions/write can modify
  Lighthouse trust anchors (authorizations list, managing tenant).
match:
- - customer_principal: null
  - HasPermission
  - customer_sub: null
where:
- node_class(?customer_sub) == AdministrativeBoundary and node_type(?customer_sub) in [Subscription, ResourceGroup]
- ?customer_principal holds EFFECTIVE Microsoft.ManagedServices/registrationDefinitions/write at ?customer_sub
  scope
- ?customer_principal holds this via Owner role ('*' actions) or a custom role explicitly granting this
  action
optional:
- - customer_sub: null
  - HasPolicy
  - reg_definition: null
emit:
  source_type: Identity
  target_type: TrustPolicy
  source: ?customer_principal
  target: <registrationDefinition TrustPolicy node in ?customer_sub>
  permissions:
  - Microsoft.ManagedServices/registrationDefinitions/write
  conditions:
  - iam_permission
  - deny_assignment
  state_logic: ACTIVE when ?customer_principal holds the write action unconditionally at the scope. CONDITIONAL(iam_permission)
    when the role assignment carries an ABAC condition or the principal has only an eligible (PIM) assignment
    for the Owner role. BLOCKED when a deny assignment (ConditionalPolicy) or deny-effect Azure Policy
    (OrganizationPolicy) at the scope or an ancestor explicitly denies Microsoft.ManagedServices/registrationDefinitions/write.
    Only Owner ('*' actions) and custom roles explicitly granting this action qualify; Contributor does
    NOT.
  confidence: min(contributing_confidences)
  derived_from:
  - <HasPermission ?customer_principal -> ?customer_sub (Owner/'*' or custom ManagedServices write) edge_id>
  false_positive_note: This edge models TRUST MODIFICATION (adding/changing principals in authorizations[],
    changing managingTenantId). A customer principal who can write registrationDefinitions can widen the
    trust list or redirect to a malicious managing tenant. Owner is the standard Azure role that includes
    this via '*' actions. A custom role must explicitly list registrationDefinitions/write. If the scope
    is a resource group, the CanModifyTrust is scoped to that RG's definition objects only.
  narrative: "{customer_principal.name} holds Owner (or a custom ManagedServices-write role) at {customer_sub.name}\
    \ and can create or modify Lighthouse registrationDefinitions \u2014 enabling them to widen the trust\
    \ authorization list or change the managing tenant entirely, directing future access to a malicious\
    \ tenant."