azure-sql-entra-admin-takeover-database

id: azure-sql-entra-admin-takeover-database
emits:
- CanReadData
- CanWriteData
description: servers/administrators/write lets a caller set any Entra identity (including themselves)
  as full DBA on all databases in the SQL server, yielding complete data-plane read and write if the SQL
  endpoint is network-reachable.
match:
- - principal: null
  - HasPermission
  - server: null
where:
- node_type(?server) == RelationalDatabase
- '?server.provider_type == ''Microsoft.Sql/servers''  # Azure SQL Database (logical server)'
- ?principal has EFFECTIVE Microsoft.Sql/servers/administrators/write at ?server scope (Owner, Contributor,
  SQL Server Contributor 6d8ee4ec-f05a-4a1d-8b00-a9b17e38b437, or custom role)
emit:
- source_type: Identity
  target_type: RelationalDatabase
  source: ?principal
  target: ?server
  edge_type: CanReadData
  permissions:
  - Microsoft.Sql/servers/administrators/write
  conditions:
  - iam_permission
  - network_reachability
  confidence: '0.97'
  derived_from:
  - <HasPermission edge_id (administrators/write)>
- source_type: Identity
  target_type: RelationalDatabase
  source: ?principal
  target: ?server
  edge_type: CanWriteData
  permissions:
  - Microsoft.Sql/servers/administrators/write
  conditions:
  - iam_permission
  - network_reachability
  confidence: '0.97'
  derived_from:
  - <HasPermission edge_id (administrators/write)>
state_logic: "The ARM control-plane action (setting Entra admin) succeeds from any network that can reach\
  \ ARM (management.azure.com) and is NOT gated by SQL firewall. However, the data-plane EXECUTION of\
  \ queries as the Entra admin IS gated by SQL endpoint reachability. State therefore depends on ?server\
  \ network exposure: (1) if ?server has ExposedToInternet edge: ACTIVE (endpoint reachable from internet);\
  \ (2) if ?server.properties.publicNetworkAccess == 'Disabled' AND no PrivateEndpoint\n    or VNet service\
  \ endpoint is detected for ?principal: CONDITIONAL(network_reachability)\n    (endpoint not publicly\
  \ exposed; principal must have pre-existing network access);\n(3) else if firewall rule allows ?principal's\
  \ IP or principal is in VNet with service\n    endpoint: ACTIVE (network path exists).\nIf a deny assignment\
  \ or deny Azure Policy covers administrators/write at the effective scope: BLOCKED."
false_positive_note: 'CRITICAL DISTINCTION: The ARM control-plane action (set Entra admin) is NOT gated
  by SQL network configuration. The permission evaluation must succeed at ARM. However, the subsequent
  data-plane access (query execution) IS gated by SQL endpoint reachability. An attacker who sets themselves
  as Entra admin on a SQL server with publicNetworkAccess=Disabled cannot connect to port 1433 to exploit
  it without a pre-existing foothold in the allowed network (private endpoint, VNet service endpoint,
  or allowlisted IP). The CanReadData/CanWriteData edges therefore must incorporate network_reachability
  in conditions. The rule emits network-gated state, not a blanket ACTIVE. If the endpoint is publicly
  exposed (ExposedToInternet edge exists), the condition automatically resolves to ACTIVE. If the server
  is private-only, the condition is CONDITIONAL(network_reachability) unless a private endpoint or VNet
  service endpoint can be proven for the principal.'
narrative: "{principal.name} holds Microsoft.Sql/servers/administrators/write on {server.name}, allowing\
  \ it to designate any Entra identity \u2014 including itself \u2014 as the Entra administrator. The\
  \ Entra admin automatically receives db_owner on all databases in the server. Execution of queries as\
  \ the admin requires network reachability to the SQL endpoint (port 1433). If {server.name} has publicNetworkAccess=Disabled,\
  \ the attacker needs pre-existing access to a private endpoint or VNet service endpoint to connect."