azure-mg-elevate-access-root

id: azure-mg-elevate-access-root
emits:
- CanGrantPermission
- Controls
description: A Microsoft Entra Global Administrator can call elevateAccess to gain User Access Administrator
  at root scope (/), controlling the root management group and thus every subscription in the tenant.
match:
- - principal: null
  - MemberOf
  - ga_role: null
- - tenant: null
  - Contains
  - root_mg: null
where:
- ?ga_role is the Microsoft Entra directory role 'Global Administrator'
- node_type(?tenant) == Tenant
- 'node_type(?root_mg) == ManagementGroup and is_root_management_group(?root_mg)  # root MG ID == Entra
  tenant ID'
emit:
- edge: Controls
  source: ?principal
  target: ?root_mg
  permissions:
  - Microsoft.Authorization/elevateAccess/action
  - Microsoft.Authorization/roleAssignments/write
  conditions:
  - iam_permission
  state_logic: "CONDITIONAL(iam_permission) \u2014 gated on the principal ACTIVELY holding the Global\
    \ Administrator directory role (if PIM-eligible-not-active, the principal must first activate) AND\
    \ performing the elevateAccess action (POST /providers/Microsoft.Authorization/elevateAccess?api-version=2016-07-01),\
    \ which assigns User Access Administrator at root scope '/'. Once elevated, the capability is ACTIVE\
    \ tenant-wide. Controls(?principal -> ?root_mg) feeds hierarchy-chains.yaml admin-inherits-down-contains\
    \ to reach EVERY subscription (CanEnterSubscription each) and CanEnterTenant. Do NOT enumerate the\
    \ subscriptions here."
  confidence: min(contributing_confidences)
  derived_from:
  - <MemberOf principal->Global Administrator edge_id>
  - <Contains tenant->root_mg edge_id (azure-mg-root-tenant-link)>
- edge: CanGrantPermission
  source: ?principal
  target: ?principal
  scope: /
  permissions:
  - Microsoft.Authorization/elevateAccess/action
  - Microsoft.Authorization/roleAssignments/write
  conditions:
  - iam_permission
  state_logic: "CONDITIONAL(iam_permission) \u2014 same gating as the Controls edge (hold/activate Global\
    \ Administrator, then call elevateAccess). Once elevated to User Access Administrator at root scope\
    \ '/', the self-grant is ACTIVE tenant-wide; can-control.yaml control-boundary-via-iam-admin reads\
    \ scope_of == '/' (a boundary) and rolls this up to Controls(root MG) \u2014 deduped against the Controls\
    \ edge above on (Controls, principal, root MG / tenant)."
  confidence: min(contributing_confidences)
  derived_from:
  - <MemberOf principal->Global Administrator edge_id>
  - <Contains tenant->root_mg edge_id (azure-mg-root-tenant-link)>
false_positive_note: "Fire ONLY for principals that hold the Microsoft Entra GLOBAL ADMINISTRATOR directory\
  \ role \u2014 no other role can call elevateAccess (it is directory-role-gated, not an ARM permission\
  \ a subscription/MG Owner can obtain). Emit at ROOT scope '/' only; do not attribute root control to\
  \ a non-root MG Owner. Keep CONDITIONAL(iam_permission): this is a deliberate two-step action (hold/activate\
  \ GA, then call elevateAccess), not an ambient path \u2014 path scoring must reflect the extra step.\
  \ The self-grant CanGrantPermission carries scope '/' (source==target==principal); it is NOT pointed\
  \ at the root MG boundary (schema target=[Identity]). Overlaps azure/identity-escalation.yaml azure-directory-role-assign\
  \ (directory-role self-grant reaching tenant control); this rule is the RESOURCE-plane elevateAccess\
  \ route to the root MG \u2014 dedupe on (Controls, principal, root MG / tenant)."
narrative: "{principal.name} is a Global Administrator and can call elevateAccess to obtain User Access\
  \ Administrator at root scope '/', controlling the root management group and thus every subscription\
  \ in the tenant \u2014 a tenant-wide takeover."