azure-policy-assignment-delete
Delete a policy assignment, removing the guardrail at that scope. For Deny-effect assignments this unblocks all previously-denied ARM operations at the scope. Destructive impact (cover-tracks); not modeled as escalation.
match (effective permission)
{
"action": "Microsoft.Authorization/policyAssignments/delete",
"scope_type": "resource|resourceGroup|subscription|managementGroup"
}
where
principal effectively holds Microsoft.Authorization/policyAssignments/delete at the scope
emit
| source type | Identity |
|---|---|
| target type | ConfigurationService |
| source | <principal> |
| target | <policy assignment (ConfigurationService)> |
| permissions | Microsoft.Authorization/policyAssignments/delete |
| state logic | ACTIVE when the principal holds policyAssignments/delete at the scope. BLOCKED if a deny assignment covers policyAssignments/delete. CanDelete is excluded from default path traversal (schema/edges.yaml traversal: walkable: false) — surfaced for analyst review and impact assessment. Deleting a management-group assignment removes enforcement from all descendant subscriptions simultaneously. |
Narrative
{principal.name} can delete a policy assignment (Microsoft.Authorization/policyAssignments/delete), removing the guardrail at the assignment scope. Deleting a Deny-effect assignment unblocks all previously-denied operations at that scope. This is a cover-tracks / governance-weakening primitive with no direct escalation consequence.
Raw rule rules/derived/azure/policy.yaml
id: azure-policy-assignment-delete
emits: CanDelete
description: Delete a policy assignment, removing the guardrail at that scope. For Deny-effect assignments
this unblocks all previously-denied ARM operations at the scope. Destructive impact (cover-tracks);
not modeled as escalation.
match_effective_permission:
action: Microsoft.Authorization/policyAssignments/delete
scope_type: resource|resourceGroup|subscription|managementGroup
where:
- principal effectively holds Microsoft.Authorization/policyAssignments/delete at the scope
emit:
source_type: Identity
target_type: ConfigurationService
source: <principal>
target: <policy assignment (ConfigurationService)>
permissions:
- Microsoft.Authorization/policyAssignments/delete
conditions: []
state_logic: "ACTIVE when the principal holds policyAssignments/delete at the scope. BLOCKED if a deny\
\ assignment covers policyAssignments/delete. CanDelete is excluded from default path traversal (schema/edges.yaml\
\ traversal: walkable: false) \u2014 surfaced for analyst review and impact assessment. Deleting a\
\ management-group assignment removes enforcement from all descendant subscriptions simultaneously."
confidence: 0.95
derived_from:
- 'effective permission: Microsoft.Authorization/policyAssignments/delete'
false_positive_note: "This is a DESTRUCTIVE / EVASION primitive (CanDelete, walkable: false). Do NOT\
\ chain to CanEscalateTo or CanExecuteAs \u2014 the delete removes a control, it does not grant new\
\ permissions. Secondary effect: deleting a Deny-effect assignment may upgrade BLOCKED edges to ACTIVE\
\ where the policy was the deny source. This secondary effect is the policy-engine's responsibility\
\ to re-evaluate, not a direct derived edge from CanDelete. Scope matters: deleting at MG scope is\
\ org-wide; at subscription scope is subscription-wide."
narrative: '{principal.name} can delete a policy assignment (Microsoft.Authorization/policyAssignments/delete),
removing the guardrail at the assignment scope. Deleting a Deny-effect assignment unblocks all previously-denied
operations at that scope. This is a cover-tracks / governance-weakening primitive with no direct escalation
consequence.'