azure-mg-owner-admin

Owner at a management group scope administers that boundary; feeds can-control -> Controls -> subtree descent.

derived azure emits CanAdminister

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`*`
source	`?principal`
target	`?mg`
permissions	`Microsoft.Management/managementGroups/` `Microsoft.Authorization/`
conditions	`iam_permission` `deny_assignment`
state logic	ACTIVE when Owner is unconditionally assigned at ?mg; CONDITIONAL(iam_permission) when the assignment is PIM-eligible-not-active or gated by an ABAC condition; BLOCKED when an MG-scoped deny assignment suppresses the actions. Feeds can-control.yaml control-via-admin -> Controls(?mg), then hierarchy-chains.yaml admin-inherits-down-contains descends to every descendant subscription/RG/resource (+ CanEnterSubscription per child subscription). Do NOT enumerate descendants here.

source type

Identity

target type

*

source

?principal

target

?mg

permissions

Microsoft.Management/managementGroups/* Microsoft.Authorization/*

conditions

iam_permission deny_assignment

state logic

ACTIVE when Owner is unconditionally assigned at ?mg; CONDITIONAL(iam_permission) when the assignment is PIM-eligible-not-active or gated by an ABAC condition; BLOCKED when an MG-scoped deny assignment suppresses the actions. Feeds can-control.yaml control-via-admin -> Controls(?mg), then hierarchy-chains.yaml admin-inherits-down-contains descends to every descendant subscription/RG/resource (+ CanEnterSubscription per child subscription). Do NOT enumerate descendants here.

Narrative

{principal.name} holds Owner at management group {mg.name} and administers that boundary; control inherits to every subscription and resource nested under it.

Raw rule rules/derived/azure/mgmtgroups.yaml

id: azure-mg-owner-admin
emits: CanAdminister
description: Owner at a management group scope administers that boundary; feeds can-control -> Controls
  -> subtree descent.
match:
- - principal: null
  - HasPermission
  - mg: null
where:
- node_type(?mg) == ManagementGroup
- ?principal effectively holds the Owner role (or a custom role with Microsoft.Management/managementGroups/*
  AND Microsoft.Authorization/*) at ?mg scope
emit:
  source_type: Identity
  target_type: '*'
  source: ?principal
  target: ?mg
  permissions:
  - Microsoft.Management/managementGroups/*
  - Microsoft.Authorization/*
  conditions:
  - iam_permission
  - deny_assignment
  state_logic: ACTIVE when Owner is unconditionally assigned at ?mg; CONDITIONAL(iam_permission) when
    the assignment is PIM-eligible-not-active or gated by an ABAC condition; BLOCKED when an MG-scoped
    deny assignment suppresses the actions. Feeds can-control.yaml control-via-admin -> Controls(?mg),
    then hierarchy-chains.yaml admin-inherits-down-contains descends to every descendant subscription/RG/resource
    (+ CanEnterSubscription per child subscription). Do NOT enumerate descendants here.
  confidence: min(contributing_confidences)
  derived_from:
  - <HasPermission principal->mg (Owner @ MG) edge_id>
  false_positive_note: "Only Owner (or a custom role that actually carries both the management-group and\
    \ Microsoft.Authorization/* actions) administers the boundary. Contributor and Management Group Contributor\
    \ CANNOT assign RBAC and are NOT boundary admins for escalation \u2014 do not emit for them. Reader\
    \ / MG Reader / Resource Policy Contributor grant no control. Custom roles with DataActions cannot\
    \ be assigned at MG scope, so never infer data-plane control here."
  narrative: '{principal.name} holds Owner at management group {mg.name} and administers that boundary;
    control inherits to every subscription and resource nested under it.'