azure-sub-cross-tenant-transfer

id: azure-sub-cross-tenant-transfer
emits: CrossTenantTrust
description: A subscription associated/transferred to a different Entra tenant is a boundary-crossing
  trust (rare, privileged).
match:
- - home_tenant: null
  - Contains
  - sub: null
where:
- node_class(?sub) == AdministrativeBoundary and node_type(?sub) == Subscription
- 'node_class(?home_tenant) == AdministrativeBoundary and node_type(?home_tenant) == Tenant  # ?sub''s
  home tenant'
- "?sub is associated to (or transferable to) a tenant different from ?home_tenant \u2014 evidenced by\
  \ a Microsoft.Subscription alias / billing transfer to another tenantId, or a B2B principal from tenantId\
  \ != sub home tenant holding RBAC"
emit:
  source: ?home_tenant
  target: <external tenant (the destination/associated tenantId)>
  permissions:
  - Microsoft.Subscription/aliases/write
  - billing subscription transfer
  conditions:
  - transfer_consent
  state_logic: "CONDITIONAL(transfer_consent): a directory change / billing transfer requires billing-owner\
    \ rights on the source AND admin acceptance in the destination tenant \u2014 it is not a routine,\
    \ one-sided action. Emit as a low-confidence boundary-crossing fact, not an active path. For the B2B-guest-with-RBAC\
    \ case, the trust is ACTIVE (the guest already holds the assignment) but the subscription-entry itself\
    \ derives via azure-sub-enter-subscription from the guest's Controls/CanAdminister."
  confidence: '0.6'
  derived_from:
  - <Contains(tenant->sub) + alias/roleAssignment edge_id evidencing cross-tenant association>
  note: "CrossTenantTrust source set (schema) is [Tenant, ApplicationIdentity] and target [Tenant, ExternalIdentity]\
    \ \u2014 so the edge is sourced from the subscription's HOME TENANT node (not the Subscription node)\
    \ to the external/destination tenant, per edges.yaml. The subscription is the SUBJECT of the transfer,\
    \ but the trust relationship is tenant-to-tenant."
  false_positive_note: Subscription transfer to another tenant is rare and heavily gated (billing + target-tenant
    consent); do NOT present it as a routine attack step. Distinguish it from the common B2B-guest-with-RBAC
    case, which is an ordinary cross-tenant assignment whose subscription foothold is already captured
    by azure-sub-enter-subscription. Keep low confidence and CONDITIONAL.
  narrative: The tenant that owns subscription {sub.name} trusts external tenant {target.name}; a principal
    in that tenant may gain control-plane reach into {sub.name} (transfer/association requires billing
    rights and destination-tenant consent).