azure-sql-entra-admin-policy-mod-database

servers/administrators/write allows modifying the Entra admin assignment, which is equivalent to modifying the SQL access policy (who holds db_owner on all databases).

derived azure emits CanModifyPolicy

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`RelationalDatabase`
source	`?principal`
target	`?server`
permissions	`Microsoft.Sql/servers/administrators/write`
conditions	`iam_permission`
state logic	if a deny assignment or deny Azure Policy covers administrators/write at the effective scope: BLOCKED; else ACTIVE: the principal can modify the Entra admin assignment on the server, changing the security policy to grant db_owner role to any Entra identity (including themselves). This is a security-policy mutation independent of downstream data access.

source type

Identity

target type

RelationalDatabase

source

?principal

target

?server

permissions

Microsoft.Sql/servers/administrators/write

conditions

iam_permission

state logic

if a deny assignment or deny Azure Policy covers administrators/write at the effective scope: BLOCKED; else ACTIVE: the principal can modify the Entra admin assignment on the server, changing the security policy to grant db_owner role to any Entra identity (including themselves). This is a security-policy mutation independent of downstream data access.

Narrative

{principal.name} can modify the SQL access policy by setting the Entra administrator on {server.name} via Microsoft.Sql/servers/administrators/write.

Raw rule rules/derived/azure/sql.yaml

id: azure-sql-entra-admin-policy-mod-database
emits: CanModifyPolicy
description: servers/administrators/write allows modifying the Entra admin assignment, which is equivalent
  to modifying the SQL access policy (who holds db_owner on all databases).
match:
- - principal: null
  - HasPermission
  - server: null
where:
- node_type(?server) == RelationalDatabase
- '?server.provider_type == ''Microsoft.Sql/servers''  # Azure SQL Database (logical server)'
- ?principal has EFFECTIVE Microsoft.Sql/servers/administrators/write at ?server scope
emit:
  source_type: Identity
  target_type: RelationalDatabase
  source: ?principal
  target: ?server
  permissions:
  - Microsoft.Sql/servers/administrators/write
  conditions:
  - iam_permission
  state_logic: 'if a deny assignment or deny Azure Policy covers administrators/write at the effective
    scope: BLOCKED; else ACTIVE: the principal can modify the Entra admin assignment on the server, changing
    the security policy to grant db_owner role to any Entra identity (including themselves). This is a
    security-policy mutation independent of downstream data access.'
  confidence: '0.97'
  derived_from:
  - <HasPermission edge_id (administrators/write)>
  false_positive_note: This edge captures the POLICY-MODIFICATION aspect of administrators/write, independent
    of whether the attacker will subsequently use the data access. Both CanModifyPolicy and CanReadData/CanWriteData
    are emitted by separate rules on the same permission, enabling analysts to query for either capability.
  narrative: '{principal.name} can modify the SQL access policy by setting the Entra administrator on
    {server.name} via Microsoft.Sql/servers/administrators/write.'