rage.fail

azure-mg-deny-assignment-artifact

explicit azure emits HasPolicy

match (record)

{ "field": "properties.scope == managementGroup", "resource_type": "Microsoft.Authorization/denyAssignments" }

emit

source type	`*`
target type	`Policy`
source	`<management group node>`
target	`<deny assignment Policy node (ConditionalPolicy subtype)>`

Narrative

{mg.name} has deny assignment {deny.name} overriding role assignments in the subtree.

Raw rule rules/explicit/azure-mgmtgroups.yaml

id: azure-mg-deny-assignment-artifact
emits: HasPolicy
applies_to:
- azure
match_record:
  resource_type: Microsoft.Authorization/denyAssignments
  field: properties.scope == managementGroup
emit:
  source_type: '*'
  target_type: Policy
  source: <management group node>
  target: <deny assignment Policy node (ConditionalPolicy subtype)>
  api_source: Microsoft.Authorization/denyAssignments list at MG scope (api-version 2018-07-01-preview+)
  evidence_field: properties.permissions[].notActions | properties.scope
  note: Deny assignments OVERRIDE Allow role assignments -> BLOCKED edges. At MG scope almost always system-managed
    (Blueprints / Managed Apps) and NOT directly user-writable; realistic removal is deleting the owning
    assignment or the move-out reparent.
  narrative: '{mg.name} has deny assignment {deny.name} overriding role assignments in the subtree.'