azure-policy-assignment-write-governance-evasion

id: azure-policy-assignment-write-governance-evasion
emits: CanModifyPolicy
description: "Modify an existing policy assignment's parameters, scope, or enforcement mode to weaken\
  \ or disable its guardrail effect (e.g., set enforcementMode=DoNotEnforce to turn a Deny assignment\
  \ into an audit-only posture, or narrow the scope). Applies to any effect type. This is governance evasion\
  \ \u2014 separate from the execution-path rule (rule 1) which targets deployIfNotExists/modify assignments\
  \ with a bound MI."
match_effective_permission:
  action: Microsoft.Authorization/policyAssignments/write
  scope_type: resource|resourceGroup|subscription|managementGroup
where:
- principal effectively holds Microsoft.Authorization/policyAssignments/write at the scope
- "the targeted assignment uses Deny, Audit, or AuditIfNotExists effect (NOT deployIfNotExists or modify\
  \ \u2014 those are covered by rule 1)"
emit:
  source_type: Identity
  target_type: ConfigurationService
  source: <principal>
  target: <policy assignment (ConfigurationService)>
  permissions:
  - Microsoft.Authorization/policyAssignments/write
  conditions: []
  state_logic: "ACTIVE when the principal holds policyAssignments/write at the scope AND the targeted\
    \ assignment is confirmed to be a non-remediation-effect type (Deny / Audit / AuditIfNotExists). BLOCKED\
    \ if a deny assignment covers policyAssignments/write. Setting enforcementMode=DoNotEnforce on a Deny\
    \ assignment silences the deny without deleting the assignment (less obvious). Modifying assignment\
    \ parameters can narrow scope or loosen conditions. This is a DEFENSE EVASION primitive \u2014 do\
    \ NOT chain to CanExecuteAs or CanEnterSubscription."
  confidence: 0.88
  derived_from:
  - 'effective permission: Microsoft.Authorization/policyAssignments/write'
  false_positive_note: "This rule covers the EVASION case (modifying a Deny/Audit assignment). The EXECUTION\
    \ case (writing a deployIfNotExists/modify assignment with a bound MI) is rule 1 (azure-policy-assignment-write-deploy-effect).\
    \ Do not emit both rules for the same assignment \u2014 determine the effect type and apply the appropriate\
    \ rule. Modifying an assignment's enforcementMode to DoNotEnforce is a stealthy softening tactic:\
    \ the assignment still appears in the portal and compliance results but Deny actions no longer block.\
    \ This is an under-documented evasion technique; verify support for DoNotEnforce on Deny-effect assignments\
    \ in the current API version (available since API version 2020-09-01)."
  narrative: "{principal.name} can modify a Deny or Audit policy assignment (Microsoft.Authorization/policyAssignments/write),\
    \ for example setting enforcementMode=DoNotEnforce to silently disable the deny effect without deleting\
    \ the assignment or creating a visible exemption. This is a governance evasion primitive \u2014 it\
    \ weakens detective or preventive coverage without removing the assignment artefact."