azure-lighthouse-enter-subscription

id: azure-lighthouse-enter-subscription
emits: CanEnterSubscription
description: A managing-tenant ExternalPrincipal named in a subscription-scoped Lighthouse authorization
  has CanEnterSubscription into the customer subscription.
match:
- - managing_tenant: null
  - CrossTenantTrust
  - customer_tenant: null
- - reg_definition: null
  - TrustsExternalIdentity
  - external_principal: null
- - customer_sub: null
  - HasPolicy
  - reg_assignment: null
where:
- node_class(?customer_sub) == AdministrativeBoundary and node_type(?customer_sub) == Subscription
- node_class(?customer_tenant) == AdministrativeBoundary and node_type(?customer_tenant) == Tenant
- ?reg_assignment.properties.registrationDefinitionId == ?reg_definition.id
- ?external_principal is in the authorizations[] of ?reg_definition (principalId from managing-tenant
  ?managing_tenant)
- the registrationAssignment scope is the FULL SUBSCRIPTION (not a resource group)
- ?external_principal's delegation is a PERMANENT authorization (authorizations[], not eligibleAuthorizations)
- node_type(?external_principal) in [ExternalIdentity, FederatedIdentity]
- 'authorization.roleDefinitionId != ''8e3af657-a8ff-443c-a75c-2fe8c4bcb635''  # Owner excluded'
optional:
- - external_principal: null
  - HasPolicy
  - pim_policy: null
emit:
  source_type: Identity
  target_type: Subscription
  source: ?external_principal
  target: ?customer_sub
  permissions: []
  conditions:
  - trust_relationship
  - service_state
  state_logic: "ACTIVE when the authorization is a permanent entry in authorizations[] (not eligibleAuthorizations)\
    \ and the registrationAssignment provisioningState == 'Succeeded'. CONDITIONAL(pim_activation) when\
    \ the authorization appears only in eligibleAuthorizations \u2014 the managing-tenant principal must\
    \ activate PIM in their home tenant before the delegation is exercisable. CONDITIONAL(service_state)\
    \ if registrationAssignment provisioningState is 'Updating' or 'Creating'. BLOCKED if the registrationAssignment\
    \ is removed, in a Failed state, or if the customer subscription has a deny assignment or deny-effect\
    \ Azure Policy (ConditionalPolicy / OrganizationPolicy) preventing Microsoft.ManagedServices registration\
    \ at the scope. Inherits the state of the contributing CrossTenantTrust (explicit rule azure-lighthouse-cross-tenant-trust-explicit);\
    \ never stronger than the weakest contributor."
  confidence: min(contributing_confidences) * 0.97
  derived_from:
  - azure-lighthouse-cross-tenant-trust-explicit (explicit CrossTenantTrust managing-tenant -> customer-tenant)
  - ?reg_definition TrustsExternalIdentity ?external_principal (authorizations[] tuple)
  - ?customer_sub HasPolicy ?reg_assignment (registrationAssignment binding)
  - hierarchy-chains.yaml enter-boundary-rollups (CanEnterSubscription roll-up pattern)
  - azure/subscriptions.yaml#azure-sub-enter-subscription (subscription foothold shape)
  false_positive_note: "SCOPE CHECK: only emit CanEnterSubscription when the registrationAssignment scope\
    \ is the FULL SUBSCRIPTION (id pattern /subscriptions/{guid} with no /resourceGroups/ suffix). A resource-group-scoped\
    \ assignment gives the managing principal access only within that RG \u2014 emit CanAdminister within\
    \ the RG (or Controls if the delegated role carries roleAssignments/write with allowDelegatedRoleAssignments:true),\
    \ and let hierarchy-chains admin-inherits-down-contains propagate within the RG. Do NOT emit CanEnterSubscription\
    \ for RG-scoped assignments \u2014 it overstates the cross-boundary foothold. PIM-eligible entries\
    \ (eligibleAuthorizations) are NOT immediately active: keep CONDITIONAL(pim_activation). Owner (8e3af657)\
    \ cannot be delegated; if somehow present, skip. The delegated role determines what the managing-tenant\
    \ principal CAN DO inside the subscription \u2014 emit CanEnterSubscription here only; role-specific\
    \ capabilities (e.g., CanGrantPermission for UAA, CanAdminister for Contributor) are derived by the\
    \ respective rules (rule 3 for UAA; azure/subscriptions.yaml for Contributor/Owner within the customer)."
  narrative: '{external_principal.name} (from managing tenant {managing_tenant.name}) is named in the
    Lighthouse registrationDefinition {reg_definition.name} with role {delegated_role.name}; because the
    delegation covers subscription {customer_sub.name}, {external_principal.name} has a standing ARM control-plane
    foothold inside {customer_sub.name} operating as themselves from their home tenant.'