azure-policy-exemption-write
Write a policy exemption to remove a resource or scope from Azure Policy enforcement (governance evasion). For Deny-effect assignments this may unblock previously-denied ARM operations. This is a control-bypass / cover-tracks primitive - it does NOT directly grant access to the exempted resource.
match (effective permission)
{
"action": "Microsoft.Authorization/policyExemptions/write",
"scope_type": "resource|resourceGroup|subscription|managementGroup"
}
where
principal effectively holds Microsoft.Authorization/policyExemptions/write at the scope
emit
| source type | Identity |
|---|---|
| target type | ConfigurationService |
| source | <principal> |
| target | <policy exemption (ConfigurationService) or the assignment being exempted> |
| permissions | Microsoft.Authorization/policyExemptions/write |
| state logic | ACTIVE when the principal holds policyExemptions/write at the target scope. BLOCKED if a deny assignment covers policyExemptions/write. Management-group scope exemptions affect all descendant subscriptions. This edge represents the ability to write an exemption (cover-tracks/governance bypass) — it does NOT itself unblock other edges; that secondary effect is captured in analyst notes. |
Narrative
{principal.name} can write a policy exemption (Microsoft.Authorization/policyExemptions/write) removing a resource or scope from Azure Policy enforcement. For Deny-effect assignments this may unblock ARM operations that were previously denied by that policy (a preventive control bypass). This is a governance evasion primitive - it reduces compliance coverage and may unblock other attack steps, but does not by itself grant access to protected resources.
Raw rule rules/derived/azure/policy.yaml
id: azure-policy-exemption-write
emits: CanModifyPolicy
description: "Write a policy exemption to remove a resource or scope from Azure Policy enforcement (governance\
\ evasion). For Deny-effect assignments this may unblock previously-denied ARM operations. This is a\
\ control-bypass / cover-tracks primitive \u2014 it does NOT directly grant access to the exempted resource."
match_effective_permission:
action: Microsoft.Authorization/policyExemptions/write
scope_type: resource|resourceGroup|subscription|managementGroup
where:
- principal effectively holds Microsoft.Authorization/policyExemptions/write at the scope
emit:
source_type: Identity
target_type: ConfigurationService
source: <principal>
target: <policy exemption (ConfigurationService) or the assignment being exempted>
permissions:
- Microsoft.Authorization/policyExemptions/write
conditions: []
state_logic: "ACTIVE when the principal holds policyExemptions/write at the target scope. BLOCKED if\
\ a deny assignment covers policyExemptions/write. Management-group scope exemptions affect all descendant\
\ subscriptions. This edge represents the ability to write an exemption (cover-tracks/governance bypass)\
\ \u2014 it does NOT itself unblock other edges; that secondary effect is captured in analyst notes."
confidence: 0.92
derived_from:
- 'effective permission: Microsoft.Authorization/policyExemptions/write'
false_positive_note: "This is a GOVERNANCE EVASION primitive, not privilege escalation. Do NOT chain\
\ azure-policy-exemption-write directly to CanExecuteAs, CanEnterSubscription, or CanEscalateTo. The\
\ secondary effect \u2014 that exempting a Deny-effect policy may upgrade a BLOCKED edge (denied by\
\ that policy) to ACTIVE \u2014 is a policy-engine concern that the state evaluator handles separately\
\ when re-evaluating edges whose block condition was that specific policy. Exemption categories: Waiver\
\ (permanent) vs. Mitigated (temporary with expiration); both have the same security primitive. An\
\ exemption on an Audit-only assignment silences compliance findings but does NOT change any BLOCKED\
\ edge to ACTIVE (since Audit does not set BLOCKED). The exemption is itself a visible ARM resource\
\ \u2014 less stealthy than definition modification (rule 5 below)."
narrative: "{principal.name} can write a policy exemption (Microsoft.Authorization/policyExemptions/write)\
\ removing a resource or scope from Azure Policy enforcement. For Deny-effect assignments this may\
\ unblock ARM operations that were previously denied by that policy (a preventive control bypass).\
\ This is a governance evasion primitive \u2014 it reduces compliance coverage and may unblock other\
\ attack steps, but does not by itself grant access to protected resources."