azure-mhsm-guest-crosstenant

A guest/foreign-tenant principal granted a Managed HSM local role gains cross-tenant crypto access.

derived azure emits CanEnterTenant

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Tenant`
source	`?external`
target	`<home tenant of the HSM>`
permissions	`Microsoft.KeyVault/managedHsm/keys/decrypt/action`
conditions	`trust_relationship` `key_permission`
state logic	CONDITIONAL(trust_relationship): ACTIVE only when the local assignment to the external principal resolves AND the decrypted material is evidenced to unlock a home-tenant identity credential; else CONDITIONAL

source type

Identity

target type

Tenant

source

?external

target

<home tenant of the HSM>

permissions

Microsoft.KeyVault/managedHsm/keys/decrypt/action

conditions

trust_relationship key_permission

state logic

CONDITIONAL(trust_relationship): ACTIVE only when the local assignment to the external principal resolves AND the decrypted material is evidenced to unlock a home-tenant identity credential; else CONDITIONAL

Narrative

{external.name} (foreign tenant) holds a Managed HSM local role and can decrypt a wrapped home-tenant credential, gaining a foothold in the HSM's tenant.

Raw rule rules/derived/azure/managedhsm.yaml

id: azure-mhsm-guest-crosstenant
emits: CanEnterTenant
description: A guest/foreign-tenant principal granted a Managed HSM local role gains cross-tenant crypto
  access.
match:
- - external: null
  - CanDecrypt
  - key: null
where:
- ?key.provider_type == 'Microsoft.KeyVault/managedHSMs/keys'
- ?external is a B2B guest or multi-tenant service principal whose home tenant != the HSM's home tenant
- the decrypted material yields a credential/token for an identity in the HSM's home tenant (evidenced)
emit:
  source_type: Identity
  target_type: Tenant
  source: ?external
  target: <home tenant of the HSM>
  permissions:
  - Microsoft.KeyVault/managedHsm/keys/decrypt/action
  conditions:
  - trust_relationship
  - key_permission
  state_logic: 'CONDITIONAL(trust_relationship): ACTIVE only when the local assignment to the external
    principal resolves AND the decrypted material is evidenced to unlock a home-tenant identity credential;
    else CONDITIONAL'
  confidence: min(contributing_confidences) * 0.7
  derived_from:
  - ?external CanDecrypt ?key
  - external principal home tenant != HSM tenant
  false_positive_note: Cross-tenant entry only follows if the crypto op actually yields a credential/token
    usable in the HSM's tenant (e.g. decrypting a wrapped home-tenant SP secret). A guest merely decrypting
    non-credential data does NOT enter the tenant. Requires an evidenced local assignment to the external
    oid; otherwise CONDITIONAL.
  narrative: '{external.name} (foreign tenant) holds a Managed HSM local role and can decrypt a wrapped
    home-tenant credential, gaining a foothold in the HSM''s tenant.'