azure-policy-definition-write-neutralize
Overwrite a custom policy definition to change its effect from Deny (or Audit) to Disabled or Audit, neutralizing a guardrail that applies wherever that definition is assigned - potentially subscription-wide or org-wide. This is a stealthy defense-evasion primitive that modifies the definition rather than creating a visible exemption.
match (effective permission)
{
"action": "Microsoft.Authorization/policyDefinitions/write",
"scope_type": "subscription|managementGroup"
}
where
principal effectively holds Microsoft.Authorization/policyDefinitions/write at the scope
at least one active assignment references this custom definition (the modification has effect)
emit
| source type | Identity |
|---|---|
| target type | ConfigurationService |
| source | <principal> |
| target | <custom policy definition (ConfigurationService)> |
| permissions | Microsoft.Authorization/policyDefinitions/write |
| state logic | ACTIVE when the principal holds policyDefinitions/write at the scope AND the definition is a custom definition (not a built-in — built-in definitions at /providers/Microsoft.Authorization/policyDefinitions/* cannot be overwritten). CONDITIONAL(service_state) if no assignment currently references the definition (the modification has no effect on active enforcement). BLOCKED if a deny assignment covers policyDefinitions/write. Management-group scope definitions affect all subscriptions in the hierarchy; verify scope accordingly. |
Narrative
{principal.name} can overwrite the custom policy definition {target.name} (Microsoft.Authorization/policyDefinitions/write), changing its effect from Deny to Audit or Disabled. This silences compliance findings and removes the preventive guardrail at all scopes where the definition is assigned - a stealthy alternative to creating a visible exemption record.
Raw rule rules/derived/azure/policy.yaml
id: azure-policy-definition-write-neutralize
emits: CanModifyPolicy
description: "Overwrite a custom policy definition to change its effect from Deny (or Audit) to Disabled\
\ or Audit, neutralizing a guardrail that applies wherever that definition is assigned \u2014 potentially\
\ subscription-wide or org-wide. This is a stealthy defense-evasion primitive that modifies the definition\
\ rather than creating a visible exemption."
match_effective_permission:
action: Microsoft.Authorization/policyDefinitions/write
scope_type: subscription|managementGroup
where:
- principal effectively holds Microsoft.Authorization/policyDefinitions/write at the scope
- at least one active assignment references this custom definition (the modification has effect)
emit:
source_type: Identity
target_type: ConfigurationService
source: <principal>
target: <custom policy definition (ConfigurationService)>
permissions:
- Microsoft.Authorization/policyDefinitions/write
conditions: []
state_logic: "ACTIVE when the principal holds policyDefinitions/write at the scope AND the definition\
\ is a custom definition (not a built-in \u2014 built-in definitions at /providers/Microsoft.Authorization/policyDefinitions/*\
\ cannot be overwritten). CONDITIONAL(service_state) if no assignment currently references the definition\
\ (the modification has no effect on active enforcement). BLOCKED if a deny assignment covers policyDefinitions/write.\
\ Management-group scope definitions affect all subscriptions in the hierarchy; verify scope accordingly."
confidence: 0.88
derived_from:
- 'effective permission: Microsoft.Authorization/policyDefinitions/write'
false_positive_note: "Only custom policy definitions at subscription or management-group scope can be\
\ overwritten via policyDefinitions/write. BUILT-IN definitions (/providers/Microsoft.Authorization/policyDefinitions/*\
\ path) cannot be modified by any caller regardless of RBAC \u2014 do NOT emit for built-in definitions.\
\ Definition modification has effect only if the definition is currently assigned; an unassigned custom\
\ definition is a preparatory step (POTENTIAL or CONDITIONAL). This is a DEFENSE EVASION primitive:\
\ changing Deny to Disabled removes a preventive guardrail without creating a visible exemption record.\
\ Do NOT chain directly to CanEscalateTo \u2014 the path is: neutralize guardrail -> previously-BLOCKED\
\ action becomes unblocked -> attacker uses that action separately. This is a background condition\
\ change, not a direct escalation edge."
narrative: "{principal.name} can overwrite the custom policy definition {target.name} (Microsoft.Authorization/policyDefinitions/write),\
\ changing its effect from Deny to Audit or Disabled. This silences compliance findings and removes\
\ the preventive guardrail at all scopes where the definition is assigned \u2014 a stealthy alternative\
\ to creating a visible exemption record."