azure-purview-collection-admin-role-assignment
A principal is assigned the Purview Collection Admin role within a Purview account. Collection Admin allows managing collections and assigning Purview RBAC roles to other principals within the account (data-plane administrative capability).
where
role.name == 'Collection Admin' OR role.name == 'Root Collection Admin'
principalId is non-null
policyElements.purviewAccountId is non-null
emit
| source type | Identity |
|---|---|
| target type | Role |
| source | <Identity node for the principal> |
| target | <Role node representing 'Collection Admin' or 'Root Collection Admin' scoped to {purviewAccountId}> |
| state logic | ACTIVE when the account is provisioned and role assignment confirmed. |
Narrative
{principal.name} holds the Purview Collection Admin role on Purview account {account.name}, enabling them to manage collections and assign Purview RBAC roles.
Raw rule rules/explicit/azure/purview.yaml
id: azure-purview-collection-admin-role-assignment
emits: HasRole
description: A principal is assigned the Purview Collection Admin role within a Purview account. Collection
Admin allows managing collections and assigning Purview RBAC roles to other principals within the account
(data-plane administrative capability).
applies_to:
- azure
source_config:
collector: purview-policyElements-api
api_endpoint: '{purviewEndpoint}/catalog/api/policyElements'
field: roles
where:
- role.name == 'Collection Admin' OR role.name == 'Root Collection Admin'
- principalId is non-null
- policyElements.purviewAccountId is non-null
emit:
source_type: Identity
target_type: Role
source: <Identity node for the principal>
target: <Role node representing 'Collection Admin' or 'Root Collection Admin' scoped to {purviewAccountId}>
api_source: Purview policyElements API
evidence_field: roles[].name, principalId, accountId
state_logic: ACTIVE when the account is provisioned and role assignment confirmed.
narrative: '{principal.name} holds the Purview Collection Admin role on Purview account {account.name},
enabling them to manage collections and assign Purview RBAC roles.'
derived_from: []