azure-lighthouse-definition-write

id: azure-lighthouse-definition-write
emits: CanModify
description: "A customer principal with Microsoft.ManagedServices/registrationAssignments/write can create/modify\
  \ Lighthouse registrationAssignments \u2014 enable cross-tenant access."
match:
- - customer_principal: null
  - HasPermission
  - customer_sub: null
where:
- node_class(?customer_sub) == AdministrativeBoundary and node_type(?customer_sub) in [Subscription, ResourceGroup]
- ?customer_principal holds EFFECTIVE Microsoft.ManagedServices/registrationAssignments/write at ?customer_sub
  scope
- ?customer_principal holds this via Owner role ('*' actions) or a custom role explicitly granting this
  action
optional:
- - customer_sub: null
  - HasPolicy
  - reg_assignment: null
emit:
  source_type: Identity
  target_type: ResourcePolicy
  source: ?customer_principal
  target: <registrationAssignment ResourcePolicy node in ?customer_sub>
  permissions:
  - Microsoft.ManagedServices/registrationAssignments/write
  conditions:
  - iam_permission
  - deny_assignment
  state_logic: ACTIVE when ?customer_principal holds the write action unconditionally at the scope. CONDITIONAL(iam_permission)
    when the role assignment carries an ABAC condition or the principal has only an eligible (PIM) assignment
    for the Owner role. BLOCKED when a deny assignment (ConditionalPolicy) or deny-effect Azure Policy
    (OrganizationPolicy) at the scope or an ancestor explicitly denies Microsoft.ManagedServices/registrationAssignments/write.
    Only Owner ('*' actions) and custom roles explicitly granting this action qualify; Contributor does
    NOT.
  confidence: min(contributing_confidences)
  derived_from:
  - <HasPermission ?customer_principal -> ?customer_sub (Owner/'*' or custom ManagedServices write) edge_id>
  false_positive_note: "Owner is the standard Azure role that includes ManagedServices write via its '*'\
    \ actions. Contributor does NOT include Microsoft.Authorization write actions NOR Microsoft.ManagedServices\
    \ write \u2014 do NOT emit for Contributor. A custom role must explicitly list the registrationAssignments/write\
    \ action (or a wildcard that covers it). If the scope is a resource group, the CanModify is scoped\
    \ to that RG's assignment objects only, not the whole subscription."
  narrative: "{customer_principal.name} holds Owner (or a custom ManagedServices-write role) at {customer_sub.name}\
    \ and can create or modify Lighthouse registrationAssignments \u2014 enabling them to activate a definition\
    \ or change an existing delegation."