azure-synapse-set-aad-admin
workspaces/administrators/write allows setting the AAD administrator on the workspace, effectively granting that principal Synapse Administrator-equivalent data-plane access.
match (effective permission)
{
"action": "Microsoft.Synapse/workspaces/administrators/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | <principal> |
| target | <workspace AAD administrator (any principal)> |
| permissions | Microsoft.Synapse/workspaces/administrators/write |
Narrative
{principal.name} can set the AAD administrator on Synapse workspace {workspace.name} (workspaces/administrators/write), effectively granting any principal Synapse Administrator data-plane access.
Raw rule rules/derived/azure/synapse.yaml
id: azure-synapse-set-aad-admin
emits: CanGrantPermission
description: workspaces/administrators/write allows setting the AAD administrator on the workspace, effectively
granting that principal Synapse Administrator-equivalent data-plane access.
match_effective_permission:
action: Microsoft.Synapse/workspaces/administrators/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: Identity
source: <principal>
target: <workspace AAD administrator (any principal)>
permissions:
- Microsoft.Synapse/workspaces/administrators/write
false_positive_note: workspaces/administrators/write is an ARM action; it sets the AAD admin for the
workspace, which is a Synapse data-plane privilege (Synapse Administrator). The principal can use
this to add themselves or another principal as workspace admin, yielding full Synapse RBAC access.
This is a CanGrantPermission because it grants data-plane privilege to an arbitrary identity.
narrative: '{principal.name} can set the AAD administrator on Synapse workspace {workspace.name} (workspaces/administrators/write),
effectively granting any principal Synapse Administrator data-plane access.'