azure-purview-collection-admin-role-assignment

A principal is assigned the Purview Collection Admin role within a Purview account. Collection Admin allows managing collections and assigning Purview RBAC roles to other principals within the account (data-plane administrative capability).

explicit azure emits HasRole

where

role.name == 'Collection Admin' OR role.name == 'Root Collection Admin' principalId is non-null policyElements.purviewAccountId is non-null

emit

source typeIdentity
target typeRole
source<Identity node for the principal>
target<Role node representing 'Collection Admin' or 'Root Collection Admin' scoped to {purviewAccountId}>
state logicACTIVE when the account is provisioned and role assignment confirmed.

Narrative

{principal.name} holds the Purview Collection Admin role on Purview account {account.name}, enabling them to manage collections and assign Purview RBAC roles.

Raw rule rules/explicit/azure/purview.yaml

id: azure-purview-collection-admin-role-assignment
emits: HasRole
description: A principal is assigned the Purview Collection Admin role within a Purview account. Collection
  Admin allows managing collections and assigning Purview RBAC roles to other principals within the account
  (data-plane administrative capability).
applies_to:
- azure
source_config:
  collector: purview-policyElements-api
  api_endpoint: '{purviewEndpoint}/catalog/api/policyElements'
  field: roles
where:
- role.name == 'Collection Admin' OR role.name == 'Root Collection Admin'
- principalId is non-null
- policyElements.purviewAccountId is non-null
emit:
  source_type: Identity
  target_type: Role
  source: <Identity node for the principal>
  target: <Role node representing 'Collection Admin' or 'Root Collection Admin' scoped to {purviewAccountId}>
  api_source: Purview policyElements API
  evidence_field: roles[].name, principalId, accountId
  state_logic: ACTIVE when the account is provisioned and role assignment confirmed.
  narrative: '{principal.name} holds the Purview Collection Admin role on Purview account {account.name},
    enabling them to manage collections and assign Purview RBAC roles.'
  derived_from: []
move · open · esc close