rage.fail

azure-sp-add-credential

derived azure emits CanCreateCredentialFor

match (effective permission)

{ "action": "add password/certificate to servicePrincipal", "api": "MS Graph servicePrincipals/{id}/addPassword" }

where

principal is an OWNER of the SP OR holds Application.ReadWrite.All / directory role (Cloud App Admin, App Admin)

emit

source type	`Identity`
source	`<principal>`
target	`<service principal>`
permissions	`microsoft.directory/servicePrincipals/credentials/update` `Application.ReadWrite.All`

Narrative

{principal.name} can add credentials to service principal {sp.name} and authenticate as it.

Raw rule rules/derived/azure/identity-escalation.yaml

id: azure-sp-add-credential
emits: CanCreateCredentialFor
match_effective_permission:
  action: add password/certificate to servicePrincipal
  api: MS Graph servicePrincipals/{id}/addPassword
where:
- principal is an OWNER of the SP OR holds Application.ReadWrite.All / directory role (Cloud App Admin,
  App Admin)
emit:
  source_type: Identity
  source: <principal>
  target: <service principal>
  permissions:
  - microsoft.directory/servicePrincipals/credentials/update
  - Application.ReadWrite.All
  escalation: Add a client secret to a privileged SP and authenticate as it (inherit its app roles / RBAC).
  narrative: '{principal.name} can add credentials to service principal {sp.name} and authenticate as
    it.'