azure-sub-uaa-self-grant

User Access Administrator (or RBAC Administrator) at a scope can assign itself Owner - role-assignment privesc.

derived azure emits CanGrantPermission

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'scope': None}

where

node_class(?scope) == AdministrativeBoundary and node_type(?scope) in [Subscription, ResourceGroup] ?principal holds EFFECTIVE Microsoft.Authorization/roleAssignments/write at ?scope via User Access Administrator (18d7d88d-d35e-4fb5-a5c3-7773c20a72d9), RBAC Administrator (f58310d9-a9f6-439a-9e8d-f62e7b41a168), or a custom role — WITHOUT already being Owner

emit

source type	`Identity`
target type	`Identity`
source	`?principal`
target	`?principal`
permissions	`Microsoft.Authorization/roleAssignments/write`
conditions	`condition_expression` `deny_assignment` `pim_activation`
state logic	ACTIVE when roleAssignments/write is held unconditionally at ?scope. CONDITIONAL(condition_expression) when the assignment (e.g. RBAC Administrator) carries a condition restricting which roles may be assigned — if that condition does NOT exclude Owner/privileged roles the self-grant still succeeds but stays CONDITIONAL until the condition is satisfied. CONDITIONAL(pim_activation) for an eligible PIM assignment. BLOCKED when a deny assignment / deny Azure Policy forbids roleAssignments/write at the scope.

Narrative

{principal.name} holds User Access Administrator / RBAC Administrator at {scope.name} and can assign itself Owner, thereby gaining full control of {scope.name} and everything beneath it.

Raw rule rules/derived/azure/subscriptions.yaml

id: azure-sub-uaa-self-grant
emits: CanGrantPermission
description: "User Access Administrator (or RBAC Administrator) at a scope can assign itself Owner \u2014\
  \ role-assignment privesc."
match:
- - principal: null
  - HasPermission
  - scope: null
where:
- node_class(?scope) == AdministrativeBoundary and node_type(?scope) in [Subscription, ResourceGroup]
- "?principal holds EFFECTIVE Microsoft.Authorization/roleAssignments/write at ?scope via User Access\
  \ Administrator (18d7d88d-d35e-4fb5-a5c3-7773c20a72d9), RBAC Administrator (f58310d9-a9f6-439a-9e8d-f62e7b41a168),\
  \ or a custom role \u2014 WITHOUT already being Owner"
emit:
  source_type: Identity
  target_type: Identity
  source: ?principal
  target: ?principal
  permissions:
  - Microsoft.Authorization/roleAssignments/write
  conditions:
  - condition_expression
  - deny_assignment
  - pim_activation
  state_logic: "ACTIVE when roleAssignments/write is held unconditionally at ?scope. CONDITIONAL(condition_expression)\
    \ when the assignment (e.g. RBAC Administrator) carries a condition restricting which roles may be\
    \ assigned \u2014 if that condition does NOT exclude Owner/privileged roles the self-grant still succeeds\
    \ but stays CONDITIONAL until the condition is satisfied. CONDITIONAL(pim_activation) for an eligible\
    \ PIM assignment. BLOCKED when a deny assignment / deny Azure Policy forbids roleAssignments/write\
    \ at the scope."
  confidence: '0.9'
  derived_from:
  - <HasPermission edge_id (roleAssignments/write @scope via UAA/RBAC-Admin)>
  - azure/identity-escalation.yaml#azure-role-assignment-write (Phase-2 canonical CanGrantPermission emitter
    for roleAssignments/write)
  note: "The self-grant targets ?principal itself (source==target). scope_of this CanGrantPermission is\
    \ the AdministrativeBoundary ?scope, so it feeds can-control control-boundary-via-iam-admin -> Controls(?scope)\
    \ and then hierarchy-chains admin-inherits-down-contains for the subtree. The base CanGrantPermission\
    \ from roleAssignments/write is ALREADY emitted by Phase-2 azure/identity-escalation.yaml azure-role-assignment-write\
    \ (at mg | subscription | resourceGroup | resource scope) \u2014 this rule adds only the Phase-3 boundary\
    \ framing and the explicit UAA/RBAC-Admin/Contributor capability contrast. DEDUPE on (CanGrantPermission,\
    \ principal, principal, scope): if the Phase-2 edge is present, keep it and let this rule contribute\
    \ only the boundary-scoped narrative/state."
  false_positive_note: "UAA and RBAC Administrator can assign roles but have NO resource data actions\
    \ of their own \u2014 their power comes ENTIRELY from the self-grant. Contributor is excluded (no\
    \ roleAssignments/write). RBAC Administrator is condition-constrained by design; keep CONDITIONAL\
    \ unless the condition provably permits assigning a privileged role. Honor deny assignments on roleAssignments/write."
  narrative: '{principal.name} holds User Access Administrator / RBAC Administrator at {scope.name} and
    can assign itself Owner, thereby gaining full control of {scope.name} and everything beneath it.'