azure-mg-reparent

Management-group write lets a principal reparent a subscription / child MG (move it into or out of an MG), altering which RBAC and guardrails it inherits.

derived azure emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'mg': None}

where

node_type(?mg) == ManagementGroup ?principal effectively holds Microsoft.Management/managementGroups/write at the relevant scopes (child + target parent + current parent; root MG is exempt per docs)

optional

Present → upgrade the emitted state; absent → downgrade (not a hard requirement).

{'principal': None} HasPermission {'child_sub': None}

emit

source type	`Identity`
target type	`*`
source	`?principal`
target	`?mg`
permissions	`Microsoft.Management/managementGroups/write` `Microsoft.Management/managementGroups/subscriptions/write` `Microsoft.Authorization/roleAssignments/write` `Microsoft.Authorization/roleAssignments/delete` `Microsoft.Management/register/action`
conditions	`iam_permission` `deny_assignment`
state logic	ACTIVE only when the full move permission set is held at ALL required scopes (child being moved: managementGroups/write + subscriptions/write [subs only] + roleAssignments/write + roleAssignments/delete + register/action; target parent AND current parent: managementGroups/write) — root MG is exempt (default landing spot). CONDITIONAL(iam_permission) when only a subset is proven; BLOCKED under an applicable deny assignment. This is the move-OUT/into lever that feeds hierarchy-chains.yaml guardrail-removal-upgrades-blocked (escape-guardrail path).

Narrative

{principal.name} can reparent subscriptions / child management groups under {mg.name} (Microsoft.Management/managementGroups/write), changing which RBAC and policy guardrails they inherit.

Raw rule rules/derived/azure/mgmtgroups.yaml

id: azure-mg-reparent
emits: CanModifyConfiguration
description: Management-group write lets a principal reparent a subscription / child MG (move it into
  or out of an MG), altering which RBAC and guardrails it inherits.
match:
- - principal: null
  - HasPermission
  - mg: null
where:
- node_type(?mg) == ManagementGroup
- ?principal effectively holds Microsoft.Management/managementGroups/write at the relevant scopes (child
  + target parent + current parent; root MG is exempt per docs)
optional:
- - principal: null
  - HasPermission
  - child_sub: null
emit:
  source_type: Identity
  target_type: '*'
  source: ?principal
  target: ?mg
  permissions:
  - Microsoft.Management/managementGroups/write
  - Microsoft.Management/managementGroups/subscriptions/write
  - Microsoft.Authorization/roleAssignments/write
  - Microsoft.Authorization/roleAssignments/delete
  - Microsoft.Management/register/action
  conditions:
  - iam_permission
  - deny_assignment
  state_logic: "ACTIVE only when the full move permission set is held at ALL required scopes (child being\
    \ moved: managementGroups/write + subscriptions/write [subs only] + roleAssignments/write + roleAssignments/delete\
    \ + register/action; target parent AND current parent: managementGroups/write) \u2014 root MG is exempt\
    \ (default landing spot). CONDITIONAL(iam_permission) when only a subset is proven; BLOCKED under\
    \ an applicable deny assignment. This is the move-OUT/into lever that feeds hierarchy-chains.yaml\
    \ guardrail-removal-upgrades-blocked (escape-guardrail path)."
  confidence: min(contributing_confidences)
  derived_from:
  - <HasPermission principal->mg (managementGroups/write) edge_id>
  - <HasPermission subscriptions/write edge_id?>
  false_positive_note: "Reparenting needs write on THREE scopes (child, target parent, current parent),\
    \ with the root-MG exception; a single-scope managementGroups/write is NOT enough to complete a move\
    \ \u2014 downgrade to CONDITIONAL. Contributor / Management Group Contributor DO hold managementGroups/write\
    \ (they can move), so this rule MAY fire on them \u2014 but it emits only the config-modification\
    \ lever, NOT a grant/control edge. Moving a subscription where Owner is inherited from the current\
    \ MG restricts targets to MGs where the principal is also Owner (else ownership is lost) \u2014 respect\
    \ that when scoring."
  narrative: '{principal.name} can reparent subscriptions / child management groups under {mg.name} (Microsoft.Management/managementGroups/write),
    changing which RBAC and policy guardrails they inherit.'