azure-sql-entra-admin-takeover-mi

id: azure-sql-entra-admin-takeover-mi
emits:
- CanReadData
- CanWriteData
description: managedInstances/administrators/write lets a caller set any Entra identity (including themselves)
  as full DBA on all MI databases, yielding complete data-plane read and write if the MI endpoint is network-reachable.
match:
- - principal: null
  - HasPermission
  - mi: null
where:
- node_type(?mi) == RelationalDatabase
- '?mi.provider_type == ''Microsoft.Sql/managedInstances''  # Azure SQL Managed Instance'
- ?principal has EFFECTIVE Microsoft.Sql/managedInstances/administrators/write at ?mi scope (Owner, Contributor,
  SQL MI Contributor 4939a1f6-9ae0-4e48-a1e0-f2cbe897382d, or custom role)
emit:
- source_type: Identity
  target_type: RelationalDatabase
  source: ?principal
  target: ?mi
  edge_type: CanReadData
  permissions:
  - Microsoft.Sql/managedInstances/administrators/write
  conditions:
  - iam_permission
  - network_reachability
  confidence: '0.97'
  derived_from:
  - <HasPermission edge_id (administrators/write)>
- source_type: Identity
  target_type: RelationalDatabase
  source: ?principal
  target: ?mi
  edge_type: CanWriteData
  permissions:
  - Microsoft.Sql/managedInstances/administrators/write
  conditions:
  - iam_permission
  - network_reachability
  confidence: '0.97'
  derived_from:
  - <HasPermission edge_id (administrators/write)>
state_logic: "The ARM control-plane action (setting Entra admin) succeeds from any network that can reach\
  \ ARM (management.azure.com) and is NOT gated by SQL MI subnet NSG. However, the data-plane EXECUTION\
  \ of queries as the Entra admin IS gated by MI endpoint reachability. MI is VNet-internal by default\
  \ (private, 1433 only); the public endpoint (3342) requires publicDataEndpointEnabled=true + NSG rule\
  \ allowing inbound. State therefore depends on ?mi network exposure: (1) if ?mi has ExposedToInternet\
  \ edge (public endpoint enabled + NSG allows 3342):\n    ACTIVE (endpoint reachable from internet);\n\
  (2) if ?mi.properties.publicDataEndpointEnabled == false OR NSG blocks inbound 3342:\n    CONDITIONAL(network_reachability)\
  \ (only VNet-internal 1433 is available; principal\n    must be in the same VNet or have a peered network);\n\
  (3) else if principal is in same VNet as MI or has peered network access: ACTIVE. If a deny assignment\
  \ or deny Azure Policy covers administrators/write at the effective scope: BLOCKED."
false_positive_note: SQL MI is deployed inside a VNet and has no public IP by default. The private endpoint
  (1433) is only accessible within the VNet or from peered networks. The public endpoint (port 3342) requires
  publicDataEndpointEnabled=true AND an NSG rule allowing inbound 3342 from the internet. An attacker
  who sets themselves as Entra admin on a SQL MI with the public endpoint disabled cannot connect to query
  the MI from the internet. The CanReadData/CanWriteData edges therefore must incorporate network_reachability
  in conditions, with state depending on whether the public endpoint is exposed. If the public endpoint
  is exposed (ExposedToInternet edge exists), state is ACTIVE. If private-only, state is CONDITIONAL(network_reachability)
  unless the principal can prove network access to the VNet (same subnet, peered network, private endpoint).
narrative: "{principal.name} holds Microsoft.Sql/managedInstances/administrators/write on {mi.name}, allowing\
  \ it to designate any Entra identity \u2014 including itself \u2014 as the Entra administrator. The\
  \ Entra admin automatically receives db_owner on all databases in the MI. Execution of queries as the\
  \ admin requires network reachability to the MI endpoint. If {mi.name} has the public data endpoint\
  \ disabled, the attacker needs pre-existing access to the MI's VNet (or a peered network) to connect\
  \ on the private endpoint."