azure-postgres-mysql-entra-admin-set

id: azure-postgres-mysql-entra-admin-set
emits: CanModifyConfiguration
description: Entra AD administrator assignment permission allows designating an Entra principal for DB
  admin access via token authentication when activeDirectoryAuth is enabled.
match:
- - principal: null
  - HasPermission
  - server: null
where:
- node_class(?server) == Data and node_type(?server) == RelationalDatabase
- node_type(?server) matched provider_type in ['Microsoft.DBforPostgreSQL/flexibleServers', 'Microsoft.DBforMySQL/flexibleServers']
- ?principal has EFFECTIVE Microsoft.DBforPostgreSQL/flexibleServers/administrators/write OR Microsoft.DBforMySQL/flexibleServers/administrators/write
  (as applicable) at ?server scope
emit:
  source_type: Identity
  target_type: RelationalDatabase
  source: ?principal
  target: ?server
  permissions:
  - Microsoft.DBforPostgreSQL/flexibleServers/administrators/write
  - Microsoft.DBforMySQL/flexibleServers/administrators/write
  conditions:
  - iam_permission
  state_logic: 'if a deny assignment or deny Azure Policy covers administrators/write at effective scope:
    BLOCKED; elif authConfig.activeDirectoryAuth == ''Enabled'': ACTIVE (caller can set an Entra admin
    and the admin can authenticate via Entra token when network reach is available); else CONDITIONAL(service_state)
    (the Entra admin assignment succeeds at the control plane, but Entra authentication is not available
    at the data plane).'
  confidence: '0.92'
  derived_from:
  - 'HasPermission edge: source=?principal, target=?server, action=(Microsoft.DBforPostgreSQL/flexibleServers/administrators/write
    | Microsoft.DBforMySQL/flexibleServers/administrators/write)'
  false_positive_note: "Verify effective administrators/write permission via role definition resolution.\
    \ Emit CONDITIONAL(service_state) when authConfig.activeDirectoryAuth != Enabled, since the Entra\
    \ admin identity will be set but cannot authenticate. The state is ACTIVE only when BOTH the permission\
    \ exists AND Entra auth is enabled on the server. The data-plane Entra token authentication requires\
    \ network reach to the database endpoint (port 5432/3306) \u2014 see the downstream rule azure-postgres-mysql-entra-admin-readdata\
    \ which chains this to CanReadData with network_reachability as a condition."
  narrative: '{principal.name} can call Microsoft.DBforPostgreSQL/flexibleServers/administrators/write
    (or MySQL equivalent) on {server.name}, designating an Entra AD principal as the database administrator.
    When authConfig.activeDirectoryAuth is enabled, that Entra principal can authenticate to the database
    using an Entra access token and hold full admin privileges, without requiring the native password
    (network reach required).'