azure-purview-collection-admin-grant
A principal holding the Purview Collection Admin role can assign Purview RBAC roles (including Data Curator, Data Source Administrator, Collection Admin) to any other principal or to themselves via the Purview role assignment API. This enables privilege escalation within the Purview account: a Collection Admin can self-assign additional roles, elevate another compromised principal, or revoke access from other admins.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal holding Collection Admin role> |
| target | <any principal in the Purview account (including self)> |
| state logic | ACTIVE when the source principal holds Collection Admin or Root Collection Admin within the Purview account. The target can be any principal (including a third-party identity or the source principal itself). BLOCKED if the source loses the Collection Admin role or the account is deprovisioned. |
Narrative
{source.name} holds the Purview Collection Admin role on account {account.name}, enabling assignment of Purview RBAC roles to {target.name}. This includes self-assignment (Collection Admin can self-assign Data Curator), enabling privilege escalation within the Purview data-plane.
Raw rule rules/derived/azure/purview.yaml
id: azure-purview-collection-admin-grant
emits: CanGrantPermission
description: 'A principal holding the Purview Collection Admin role can assign Purview RBAC roles (including
Data Curator, Data Source Administrator, Collection Admin) to any other principal or to themselves via
the Purview role assignment API. This enables privilege escalation within the Purview account: a Collection
Admin can self-assign additional roles, elevate another compromised principal, or revoke access from
other admins.'
match:
- principal holds HasRole(Identity, Purview Collection Admin role)
- target is any Identity within the Purview account scope
where:
- source holds Collection Admin or Root Collection Admin on the Purview account
emit:
source_type: Identity
target_type: Identity
source: <principal holding Collection Admin role>
target: <any principal in the Purview account (including self)>
capabilities:
- assign Data Reader
- assign Data Curator
- assign Data Source Admin
- assign Collection Admin
conditions: []
state_logic: ACTIVE when the source principal holds Collection Admin or Root Collection Admin within
the Purview account. The target can be any principal (including a third-party identity or the source
principal itself). BLOCKED if the source loses the Collection Admin role or the account is deprovisioned.
confidence: 0.95
narrative: '{source.name} holds the Purview Collection Admin role on account {account.name}, enabling
assignment of Purview RBAC roles to {target.name}. This includes self-assignment (Collection Admin
can self-assign Data Curator), enabling privilege escalation within the Purview data-plane.'
canonical_rule: HasRole(X, Collection Admin) => CanGrantPermission(X, any Identity in account)
derived_from:
- azure-purview-collection-admin-role-assignment