azure-purview-data-source-admin-role-assignment
A principal is assigned the Purview Data Source Administrator role. Data Source Admin manages scan credentials, data sources, and integration runtimes (data-plane operational capability, includes write permissions).
where
role.name == 'Data Source Administrator'
principalId is non-null
policyElements.purviewAccountId is non-null
emit
| source type | Identity |
|---|---|
| target type | Role |
| source | <Identity node for the principal> |
| target | <Role node representing 'Data Source Administrator' scoped to {purviewAccountId}> |
| state logic | ACTIVE when the account is provisioned and role assignment confirmed. |
Narrative
{principal.name} holds the Purview Data Source Administrator role on Purview account {account.name}, enabling scan credential and data source management.
Raw rule rules/explicit/azure/purview.yaml
id: azure-purview-data-source-admin-role-assignment
emits: HasRole
description: A principal is assigned the Purview Data Source Administrator role. Data Source Admin manages
scan credentials, data sources, and integration runtimes (data-plane operational capability, includes
write permissions).
applies_to:
- azure
source_config:
collector: purview-policyElements-api
api_endpoint: '{purviewEndpoint}/catalog/api/policyElements'
field: roles
where:
- role.name == 'Data Source Administrator'
- principalId is non-null
- policyElements.purviewAccountId is non-null
emit:
source_type: Identity
target_type: Role
source: <Identity node for the principal>
target: <Role node representing 'Data Source Administrator' scoped to {purviewAccountId}>
api_source: Purview policyElements API
evidence_field: roles[].name, principalId, accountId
state_logic: ACTIVE when the account is provisioned and role assignment confirmed.
narrative: '{principal.name} holds the Purview Data Source Administrator role on Purview account {account.name},
enabling scan credential and data source management.'
derived_from: []