azure-purview-data-reader-role-assignment
A principal is assigned the Purview Data Reader role within a Purview account. This assignment is visible via the Purview REST API policyElements endpoint and materializes an explicit HasRole edge (Identity -> Role). The principal can read catalog assets, classifications, and scan results (data-plane access).
where
role.name == 'Data Reader'
principalId is non-null
policyElements.purviewAccountId is non-null
emit
| source type | Identity |
|---|---|
| target type | Role |
| source | <Identity node for the principal (from principalId) |
| target | <Role node representing 'Purview Data Reader' scoped to {purviewAccountId}> |
| state logic | ACTIVE when the Purview account is provisioned and the role assignment is confirmed in policyElements. CONDITIONAL(service_state) when the account is in a transient state (Creating, Updating) — assignment is visible but may not be functional. |
Narrative
{principal.name} holds the Purview Data Reader role on Purview account {account.name} (assigned via Purview RBAC, visible in policyElements).
Raw rule rules/explicit/azure/purview.yaml
id: azure-purview-data-reader-role-assignment
emits: HasRole
description: A principal is assigned the Purview Data Reader role within a Purview account. This assignment
is visible via the Purview REST API policyElements endpoint and materializes an explicit HasRole edge
(Identity -> Role). The principal can read catalog assets, classifications, and scan results (data-plane
access).
applies_to:
- azure
source_config:
collector: purview-policyElements-api
api_endpoint: '{purviewEndpoint}/catalog/api/policyElements'
field: roles
where:
- role.name == 'Data Reader'
- principalId is non-null
- policyElements.purviewAccountId is non-null
emit:
source_type: Identity
target_type: Role
source: <Identity node for the principal (from principalId)
target: <Role node representing 'Purview Data Reader' scoped to {purviewAccountId}>
api_source: 'Purview policyElements API: GET {account}/catalog/api/policyElements'
evidence_field: roles[].name, principalId, accountId
state_logic: "ACTIVE when the Purview account is provisioned and the role assignment is confirmed in\
\ policyElements. CONDITIONAL(service_state) when the account is in a transient state (Creating, Updating)\
\ \u2014 assignment is visible but may not be functional."
narrative: '{principal.name} holds the Purview Data Reader role on Purview account {account.name} (assigned
via Purview RBAC, visible in policyElements).'
derived_from: []