azure-lighthouse-uaa-sub-grant

id: azure-lighthouse-uaa-sub-grant
emits: CanGrantPermission
description: "A managing-tenant principal delegated User Access Administrator (with allowDelegatedRoleAssignments:\
  \ true) can assign roles in the customer subscription \u2014 subscription-scoped CanGrantPermission."
match:
- - external_principal: null
  - CanEnterSubscription
  - customer_sub: null
- - reg_definition: null
  - TrustsExternalIdentity
  - external_principal: null
where:
- 'authorization for ?external_principal in ?reg_definition.properties.authorizations[] has roleDefinitionId
  == ''18d7d88d-d35e-4fb5-a5c3-7773c20a72d9''  # User Access Administrator'
- '?reg_definition.properties.authorizations[matching].allowDelegatedRoleAssignments == true  # Lighthouse-specific
  flag enabling sub-delegation'
- node_type(?customer_sub) == Subscription
optional:
- - external_principal: null
  - HasPolicy
  - pim_policy: null
emit:
  source_type: Identity
  target_type: Identity
  source: ?external_principal
  target: ?external_principal
  scope: ?customer_sub
  permissions:
  - Microsoft.Authorization/roleAssignments/write
  conditions:
  - trust_relationship
  - iam_permission
  - deny_assignment
  state_logic: 'ACTIVE when the UAA delegation is in a permanent authorization[] with allowDelegatedRoleAssignments:
    true and the registrationAssignment is active. CONDITIONAL(pim_activation) when the UAA entry is in
    eligibleAuthorizations (JIT-gated). BLOCKED when a customer deny assignment or deny-effect Azure Policy
    suppresses Microsoft.Authorization/roleAssignments/write at the subscription scope. State inherits
    from the contributing CanEnterSubscription edge (rule 2), which itself inherits from azure-lighthouse-cross-tenant-trust
    (rule 1). Feeds can-control.yaml control-boundary-via-iam-admin (scope_of == ?customer_sub -> Controls(?customer_sub))
    + hierarchy-chains.yaml admin-inherits-down-contains to every descendant RG and resource. Do NOT enumerate
    descendants here.'
  confidence: min(contributing_confidences) * 0.92
  derived_from:
  - azure-lighthouse-enter-subscription (?external_principal CanEnterSubscription ?customer_sub)
  - ?reg_definition TrustsExternalIdentity ?external_principal (UAA + allowDelegatedRoleAssignments:true)
  - can-control.yaml#control-boundary-via-iam-admin (CanGrantPermission@boundary -> Controls(boundary))
  - azure/identity-escalation.yaml#azure-role-assignment-write (canonical CanGrantPermission from roleAssignments/write)
  false_positive_note: "BOTH conditions are required: roleDefinitionId MUST be User Access Administrator\
    \ (18d7d88d-d35e-4fb5-a5c3-7773c20a72d9) AND the authorization entry MUST have allowDelegatedRoleAssignments:\
    \ true. A plain UAA delegation WITHOUT the flag cannot create role assignments in the customer scope\
    \ \u2014 Lighthouse explicitly blocks cross-tenant sub-delegation by default. Do NOT emit for Contributor\
    \ or any other delegated role even if they have broad resource write access. The self-grant edge (source==target==?external_principal)\
    \ carries scope=?customer_sub; it is NOT pointed at the Subscription boundary node (CanGrantPermission\
    \ schema target=[Identity] only). The boundary-level Controls consequence comes from can-control control-boundary-via-iam-admin\
    \ reading scope_of \u2014 do not derive Controls here. A customer deny assignment on roleAssignments/write\
    \ blocks this -> BLOCKED; hierarchy-chains guardrail-removal-upgrades-blocked can upgrade it only\
    \ if the managing principal can remove the guardrail (requires Owner at customer \u2014 not possible\
    \ via Lighthouse alone)."
  narrative: '{external_principal.name} holds a Lighthouse User Access Administrator delegation with allowDelegatedRoleAssignments:
    true in subscription {customer_sub.name}. They can assign roles (including Owner) to any principal
    within the customer scope, effectively gaining full administrative control of {customer_sub.name}.'