azure-mi-contributor
Principal with full control of the MI ARM object (Managed Identity Contributor / Contributor / Owner at scope) can administer the user-assigned identity resource.
match (effective permission)
{
"action": "Microsoft.ManagedIdentity/userAssignedIdentities/*",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | ManagedIdentity |
| source | <principal> |
| target | <user-assigned managed identity> |
| permissions | Microsoft.ManagedIdentity/userAssignedIdentities/* |
| state logic | ACTIVE when the principal holds the wildcard action at scope. BLOCKED if a deny assignment suppresses the action on the MI resource. |
Narrative
{principal.name} has full control of user-assigned MI {target.name} (Microsoft.ManagedIdentity/userAssignedIdentities/*), including the ability to add/remove federated credentials, modify tags, and delete the MI.
Raw rule rules/explicit/azure-managedidentity.yaml
id: azure-mi-contributor
emits: CanAdminister
applies_to:
- azure
description: Principal with full control of the MI ARM object (Managed Identity Contributor / Contributor
/ Owner at scope) can administer the user-assigned identity resource.
match_effective_permission:
action: Microsoft.ManagedIdentity/userAssignedIdentities/*
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: ManagedIdentity
source: <principal>
target: <user-assigned managed identity>
permissions:
- Microsoft.ManagedIdentity/userAssignedIdentities/*
conditions: []
state_logic: ACTIVE when the principal holds the wildcard action at scope. BLOCKED if a deny assignment
suppresses the action on the MI resource.
confidence: 0.95
narrative: '{principal.name} has full control of user-assigned MI {target.name} (Microsoft.ManagedIdentity/userAssignedIdentities/*),
including the ability to add/remove federated credentials, modify tags, and delete the MI.'
false_positive_note: "CanAdminister over the MI ARM object grants control of the MI resource (metadata,\
\ tags, federated credentials, deletion) but does NOT by itself yield the MI's bearer token \u2014\
\ that requires a foothold on an attached compute host. The Managed Identity Operator role (assign/action\
\ only) does NOT qualify for CanAdminister; it qualifies only for CanPassIdentity (already modeled\
\ in azure-assign-user-assigned-mi, identity-escalation.yaml). Contributor/Owner at the enclosing\
\ RG/subscription inherits down via hierarchy-chains admin-inherits-down-contains."