azure-policy-setdefinition-write-neutralize
Overwrite a custom policy set definition (initiative) to change the effect of bundled policy rules from Deny (or Audit) to Disabled or Audit, neutralizing a guardrail that applies wherever that initiative is assigned - potentially subscription-wide or org-wide. An initiative can bundle multiple deployIfNotExists or Deny rules; overwriting one has the same org-wide blast radius as modifying a single policyDefinition. This is a stealthy defense-evasion primitive.
match (effective permission)
{
"action": "Microsoft.Authorization/policySetDefinitions/write",
"scope_type": "subscription|managementGroup"
}
where
principal effectively holds Microsoft.Authorization/policySetDefinitions/write at the scope
at least one active assignment references this custom initiative (the modification has effect)
emit
| source type | Identity |
|---|---|
| target type | ConfigurationService |
| source | <principal> |
| target | <custom policy set definition / initiative (ConfigurationService)> |
| permissions | Microsoft.Authorization/policySetDefinitions/write |
| state logic | ACTIVE when the principal holds policySetDefinitions/write at the scope AND the initiative is a custom initiative (not a built-in — built-in initiatives at /providers/Microsoft.Authorization/policySetDefinitions/* cannot be overwritten). CONDITIONAL(service_state) if no assignment currently references the initiative (the modification has no effect on active enforcement). BLOCKED if a deny assignment covers policySetDefinitions/write. Management-group scope initiatives affect all subscriptions in the hierarchy; verify scope accordingly. |
Narrative
{principal.name} can overwrite the custom policy set definition (initiative) {target.name} (Microsoft.Authorization/policySetDefinitions/write), changing the effect of bundled Deny or Audit rules to Audit or Disabled. This silences compliance findings and removes the preventive guardrail at all scopes where the initiative is assigned - a stealthy alternative to creating a visible exemption record.
Raw rule rules/derived/azure/policy.yaml
id: azure-policy-setdefinition-write-neutralize
emits: CanModifyPolicy
description: "Overwrite a custom policy set definition (initiative) to change the effect of bundled policy\
\ rules from Deny (or Audit) to Disabled or Audit, neutralizing a guardrail that applies wherever that\
\ initiative is assigned \u2014 potentially subscription-wide or org-wide. An initiative can bundle\
\ multiple deployIfNotExists or Deny rules; overwriting one has the same org-wide blast radius as modifying\
\ a single policyDefinition. This is a stealthy defense-evasion primitive."
match_effective_permission:
action: Microsoft.Authorization/policySetDefinitions/write
scope_type: subscription|managementGroup
where:
- principal effectively holds Microsoft.Authorization/policySetDefinitions/write at the scope
- at least one active assignment references this custom initiative (the modification has effect)
emit:
source_type: Identity
target_type: ConfigurationService
source: <principal>
target: <custom policy set definition / initiative (ConfigurationService)>
permissions:
- Microsoft.Authorization/policySetDefinitions/write
conditions: []
state_logic: "ACTIVE when the principal holds policySetDefinitions/write at the scope AND the initiative\
\ is a custom initiative (not a built-in \u2014 built-in initiatives at /providers/Microsoft.Authorization/policySetDefinitions/*\
\ cannot be overwritten). CONDITIONAL(service_state) if no assignment currently references the initiative\
\ (the modification has no effect on active enforcement). BLOCKED if a deny assignment covers policySetDefinitions/write.\
\ Management-group scope initiatives affect all subscriptions in the hierarchy; verify scope accordingly."
confidence: 0.88
derived_from:
- 'effective permission: Microsoft.Authorization/policySetDefinitions/write'
false_positive_note: "Only custom policy set definitions at subscription or management-group scope can\
\ be overwritten via policySetDefinitions/write. BUILT-IN initiatives (/providers/Microsoft.Authorization/policySetDefinitions/*\
\ path) cannot be modified by any caller regardless of RBAC \u2014 do NOT emit for built-in initiatives.\
\ Initiative modification has effect only if the initiative is currently assigned; an unassigned custom\
\ initiative is a preparatory step (POTENTIAL or CONDITIONAL). This is a DEFENSE EVASION primitive:\
\ changing bundled Deny rules to Disabled removes a preventive guardrail without creating a visible\
\ exemption record. Do NOT chain directly to CanEscalateTo \u2014 the path is: neutralize guardrail\
\ -> previously-BLOCKED action becomes unblocked -> attacker uses that action separately. This is\
\ a background condition change, not a direct escalation edge."
narrative: "{principal.name} can overwrite the custom policy set definition (initiative) {target.name}\
\ (Microsoft.Authorization/policySetDefinitions/write), changing the effect of bundled Deny or Audit\
\ rules to Audit or Disabled. This silences compliance findings and removes the preventive guardrail\
\ at all scopes where the initiative is assigned \u2014 a stealthy alternative to creating a visible\
\ exemption record."