azure-purview-arm-owner-grants-permission

An identity with ARM Contributor or Owner permission on a Microsoft.Purview/accounts resource holds the implicit Root Collection Admin role in Purview (assigned at account creation). This cross-plane escalation enables data-plane privilege escalation: the ARM admin can manage Purview role assignments, self-assign Data Curator, and control access within the data-plane.

derived azure emits CanGrantPermission

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Identity`
source	`<principal with ARM Contributor/Owner on the Purview account>`
target	`<any principal in the Purview account (including self)>`
conditions	`iam_permission`
state logic	ACTIVE when the source has effective ARM Contributor or Owner permission on the Purview account resource AND the account is provisioned. The source implicitly holds Root Collection Admin in Purview and can manage data-plane role assignments. BLOCKED if the ARM permission is revoked or account is deprovisioned.

source type

Identity

target type

Identity

source

<principal with ARM Contributor/Owner on the Purview account>

target

<any principal in the Purview account (including self)>

conditions

iam_permission

state logic

ACTIVE when the source has effective ARM Contributor or Owner permission on the Purview account resource AND the account is provisioned. The source implicitly holds Root Collection Admin in Purview and can manage data-plane role assignments. BLOCKED if the ARM permission is revoked or account is deprovisioned.

Narrative

{source.name} holds ARM Contributor/Owner on Purview account {account.name}, which implicitly grants Root Collection Admin role in the Purview data-plane. This enables {source.name} to assign or revoke Purview RBAC roles, creating a cross-plane escalation from ARM control authority to data-plane administrative capability.

Raw rule rules/derived/azure/purview.yaml

id: azure-purview-arm-owner-grants-permission
emits: CanGrantPermission
description: 'An identity with ARM Contributor or Owner permission on a Microsoft.Purview/accounts resource
  holds the implicit Root Collection Admin role in Purview (assigned at account creation). This cross-plane
  escalation enables data-plane privilege escalation: the ARM admin can manage Purview role assignments,
  self-assign Data Curator, and control access within the data-plane.'
match:
- principal has effective permission Microsoft.Purview/accounts/write (ARM Contributor/Owner)
- Purview account is provisioned (creationTime set)
where:
- source holds ARM Contributor or Owner on the Purview account resource
- Purview account provisioningState == Succeeded
emit:
  source_type: Identity
  target_type: Identity
  source: <principal with ARM Contributor/Owner on the Purview account>
  target: <any principal in the Purview account (including self)>
  capabilities:
  - assign Purview RBAC roles
  - revoke roles
  - create collections
  conditions:
  - iam_permission
  state_logic: ACTIVE when the source has effective ARM Contributor or Owner permission on the Purview
    account resource AND the account is provisioned. The source implicitly holds Root Collection Admin
    in Purview and can manage data-plane role assignments. BLOCKED if the ARM permission is revoked or
    account is deprovisioned.
  confidence: 0.95
  narrative: '{source.name} holds ARM Contributor/Owner on Purview account {account.name}, which implicitly
    grants Root Collection Admin role in the Purview data-plane. This enables {source.name} to assign
    or revoke Purview RBAC roles, creating a cross-plane escalation from ARM control authority to data-plane
    administrative capability.'
  canonical_rule: HasRole(X, Root Collection Admin [implicit from ARM Owner]) => CanGrantPermission(X,
    any Identity in Purview account)
  linchpin: 'credential-chains: ARM control-plane authority -> Purview data-plane authority'
  derived_from:
  - azure-purview-arm-owner-to-collection-admin