azure-reset-password
match (effective permission)
{
"action": "microsoft.directory/users/password/update (reset)"
}
where
principal holds Authentication Administrator / Helpdesk Administrator / User Administrator
target is not a higher-privileged admin (restricted-admin protection)
emit
| source type | Identity |
|---|---|
| source | <principal> |
| target | <user> |
| permissions | Authentication Administrator | User Administrator |
Narrative
{principal.name} can reset the password of {user.name} (Authentication/User Administrator).
Raw rule rules/derived/azure/identity-escalation.yaml
id: azure-reset-password
emits: CanResetCredential
match_effective_permission:
action: microsoft.directory/users/password/update (reset)
where:
- principal holds Authentication Administrator / Helpdesk Administrator / User Administrator
- target is not a higher-privileged admin (restricted-admin protection)
emit:
source_type: Identity
source: <principal>
target: <user>
permissions:
- Authentication Administrator | User Administrator
false_positive_note: Authentication/Helpdesk/User admins are BLOCKED from resetting credentials of higher-tier
admins; honor Entra's restricted-management protections -> BLOCKED edge.
narrative: '{principal.name} can reset the password of {user.name} (Authentication/User Administrator).'