azure-lighthouse-trusts-external-principal

id: azure-lighthouse-trusts-external-principal
emits: TrustsExternalIdentity
applies_to:
- azure
match_record:
  resource_type: Microsoft.ManagedServices/registrationDefinitions
  field: properties.authorizations
where:
- each item in properties.authorizations[] where roleDefinitionId != '8e3af657-a8ff-443c-a75c-2fe8c4bcb635'
emit:
  source_type: ResourcePolicy
  target_type: ExternalIdentity
  source: <registrationDefinition TrustPolicy node (id = definition resource id)>
  target: <ExternalPrincipal node (principalId from authorizations[], managingTenantId = home tenant)>
  api_source: GET /subscriptions/{subId}/providers/Microsoft.ManagedServices/registrationDefinitions
  evidence_field: properties.authorizations[].principalId, properties.authorizations[].roleDefinitionId,
    properties.authorizations[].principalIdDisplayName, properties.authorizations[].allowDelegatedRoleAssignments
  note: Emit one edge per authorizations[] entry. Also emit for each eligibleAuthorizations[] entry, tagging
    the edge with state=CONDITIONAL(pim_activation) and recording justInTimeAccessPolicy details (managedByTenantApprovers,
    maximumActivationDuration) on edge properties. The ExternalPrincipal node is typed ExternalIdentity
    (class=Identity); its home tenant is registrationDefinition.properties.managingTenantId. If the managing-tenant's
    graph is available and the principalId resolves to a known node, prefer that node over a synthetic
    ExternalIdentity. Record allowDelegatedRoleAssignments flag (true/false) on the edge for rule 3 consumption.
  narrative: 'RegistrationDefinition {definition.name} trusts managing-tenant principal {principal.name}
    ({principalId}) from tenant {managingTenantId} with role {roleDefinitionId}{if allowDelegatedRoleAssignments:
    '', sub-delegation enabled''}.'