azure-purview-arm-owner-to-collection-admin
An identity with ARM Contributor or Owner permission on a Microsoft.Purview/accounts resource is automatically granted the Purview Root Collection Admin role within the account at creation. This is an ARM control-plane to Purview data-plane escalation: ARM admin authority over the account resource carries over to data-plane administrative capability. Per Microsoft documentation, the account creator is assigned Root Collection Admin in Purview, enabling role assignment and privilege escalation within the Purview scope.
match (effective permission)
where
emit
| source type | Identity |
|---|---|
| target type | Role |
| source | <Identity with ARM Contributor/Owner on the Purview account> |
| target | <Role node representing 'Root Collection Admin' scoped to the Purview account> |
| conditions | iam_permission |
| state logic | ACTIVE when the principal holds ARM Contributor or Owner on the Purview account resource AND the account is provisioned (creationTime is set). The Root Collection Admin role is immediately assigned at account creation; no separate Purview RBAC collection is needed. |
Narrative
{principal.name} holds ARM Contributor/Owner on Purview account {account.name}. Per Microsoft Purview documentation, this automatically grants Root Collection Admin role within the Purview data-plane, enabling role assignment and privilege escalation within the account.
Raw rule rules/explicit/azure/purview.yaml
id: azure-purview-arm-owner-to-collection-admin
emits: HasRole
description: 'An identity with ARM Contributor or Owner permission on a Microsoft.Purview/accounts resource
is automatically granted the Purview Root Collection Admin role within the account at creation. This
is an ARM control-plane to Purview data-plane escalation: ARM admin authority over the account resource
carries over to data-plane administrative capability. Per Microsoft documentation, the account creator
is assigned Root Collection Admin in Purview, enabling role assignment and privilege escalation within
the Purview scope.'
applies_to:
- azure
source_config:
resource_type: Microsoft.Purview/accounts
field: properties
match_effective_permission:
action: Microsoft.Purview/accounts/write
scope_type: purview-account
where:
- principal has effective permission Microsoft.Purview/accounts/write (Contributor or Owner on account)
- Purview account properties.creationTime is populated (account is provisioned)
emit:
source_type: Identity
target_type: Role
source: <Identity with ARM Contributor/Owner on the Purview account>
target: <Role node representing 'Root Collection Admin' scoped to the Purview account>
api_source: ARM effective-permission evaluator + Purview documentation
evidence_field: ARM roleAssignment (Contributor/Owner on Microsoft.Purview/accounts) + account.creationTime
state_logic: ACTIVE when the principal holds ARM Contributor or Owner on the Purview account resource
AND the account is provisioned (creationTime is set). The Root Collection Admin role is immediately
assigned at account creation; no separate Purview RBAC collection is needed.
conditions:
- iam_permission
confidence: 0.95
narrative: '{principal.name} holds ARM Contributor/Owner on Purview account {account.name}. Per Microsoft
Purview documentation, this automatically grants Root Collection Admin role within the Purview data-plane,
enabling role assignment and privilege escalation within the account.'
derived_from: []