azure-purview-catalog-read

A principal holding Purview Data Reader (or higher-privilege roles: Data Curator, Data Source Administrator, Collection Admin) with network reachability to the Purview account can enumerate all catalog assets, classifications, scan results, and data lineage via the Purview REST API, enabling reconnaissance of sensitive data sources and classifications across the organization.

explicit azure emits CanRead

match (effective permission)

{ "roles": [ "Data Reader", "Data Curator", "Data Source Administrator", "Collection Admin", "Root Collection Admin" ], "scope_type": "purview-account", "source": "Purview policyElements API (data-plane role assignments)" }

where

principal holds HasRole(Identity, Purview Data Reader role) OR HasRole(Identity, Data Curator/Admin/Collection Admin role) Purview account publicNetworkAccess is not Disabled, OR principal has network access to the private endpoint Purview account provisioningState == Succeeded

emit

source type	`Identity`
target type	`ConfigurationService`
source	`<principal holding Purview Data Reader or higher role>`
target	`<Purview account (ConfigurationService, provider_type: Microsoft.Purview/accounts)>`
permissions	`Purview Data Reader (data-plane role, not ARM RBAC)` `Purview Data Curator (subset; includes read)` `Purview Collection Admin (subset; includes read)` `Purview Root Collection Admin (subset; includes read)`
conditions	`network_reachability`
state logic	ACTIVE when the principal holds Purview Data Reader (or a higher-privilege role) within the account AND the account catalog endpoint is reachable (publicNetworkAccess != Disabled, OR principal is in-network for private endpoint). CONDITIONAL(network_reachability) when publicNetworkAccess is Disabled — requires verified network access to the VNet hosting the private endpoint. BLOCKED if the account is deprovisioned (provisioningState != Succeeded).

Narrative

{principal.name} holds the Purview Data Reader role on Purview account {target.name}, enabling enumeration of all registered data sources, scan classification results (e.g., which storage accounts contain PII or credentials), and data lineage across the organization. This is a recon primitive: the attacker learns where high-value data lives and can target those data stores with separate data-plane permissions. Reading the catalog does NOT grant access to the data it describes.

Raw rule rules/explicit/azure/purview.yaml

id: azure-purview-catalog-read
emits: CanRead
description: 'A principal holding Purview Data Reader (or higher-privilege roles: Data Curator, Data Source
  Administrator, Collection Admin) with network reachability to the Purview account can enumerate all
  catalog assets, classifications, scan results, and data lineage via the Purview REST API, enabling reconnaissance
  of sensitive data sources and classifications across the organization.'
applies_to:
- azure
match_effective_permission:
  roles:
  - Data Reader
  - Data Curator
  - Data Source Administrator
  - Collection Admin
  - Root Collection Admin
  scope_type: purview-account
  source: Purview policyElements API (data-plane role assignments)
where:
- principal holds HasRole(Identity, Purview Data Reader role) OR HasRole(Identity, Data Curator/Admin/Collection
  Admin role)
- Purview account publicNetworkAccess is not Disabled, OR principal has network access to the private
  endpoint
- Purview account provisioningState == Succeeded
emit:
  source_type: Identity
  target_type: ConfigurationService
  source: <principal holding Purview Data Reader or higher role>
  target: '<Purview account (ConfigurationService, provider_type: Microsoft.Purview/accounts)>'
  permissions:
  - Purview Data Reader (data-plane role, not ARM RBAC)
  - Purview Data Curator (subset; includes read)
  - Purview Collection Admin (subset; includes read)
  - Purview Root Collection Admin (subset; includes read)
  conditions:
  - network_reachability
  state_logic: "ACTIVE when the principal holds Purview Data Reader (or a higher-privilege role) within\
    \ the account AND the account catalog endpoint is reachable (publicNetworkAccess != Disabled, OR principal\
    \ is in-network for private endpoint). CONDITIONAL(network_reachability) when publicNetworkAccess\
    \ is Disabled \u2014 requires verified network access to the VNet hosting the private endpoint. BLOCKED\
    \ if the account is deprovisioned (provisioningState != Succeeded)."
  confidence: 0.85
  derived_from:
  - azure-purview-data-reader-role-assignment
  - azure-purview-data-curator-role-assignment
  - azure-purview-collection-admin-role-assignment
  - azure-purview-data-source-admin-role-assignment
  false_positive_note: "Do NOT emit CanReadData or CanReadSecret on target data stores from this edge\
    \ alone. Reading the Purview catalog reveals classification METADATA and data SOURCE locations \u2014\
    \ it does NOT grant access to the described data. Separate data-plane permissions on those stores\
    \ are required for actual data access. Additionally, Purview data-plane roles are NOT visible via\
    \ ARM Microsoft.Authorization/roleAssignments enumeration; collector must query the Purview RBAC API\
    \ (policyElements endpoint) within the account. ARM Owner/Contributor on the subscription does NOT\
    \ automatically grant Purview data-plane read \u2014 verify Purview role assignments independently.\
    \ If publicNetworkAccess is Disabled, downgrade to CONDITIONAL(network_reachability)."
  narrative: '{principal.name} holds the Purview Data Reader role on Purview account {target.name}, enabling
    enumeration of all registered data sources, scan classification results (e.g., which storage accounts
    contain PII or credentials), and data lineage across the organization. This is a recon primitive:
    the attacker learns where high-value data lives and can target those data stores with separate data-plane
    permissions. Reading the catalog does NOT grant access to the data it describes.'