azure-synapse-sql-admin-data-read

Synapse SQL Administrator (distinct from Synapse Administrator) grants SQL-admin (db_owner) on ALL dedicated SQL pools - a legitimate, narrowly-scoped role for SQL DBAs.

derived azure emits CanReadData

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`Data`
source	`<principal>`
target	`<dedicated SQL pool (DataWarehouse)>`
permissions	`Synapse RBAC: Synapse SQL Administrator (db_owner on dedicated SQL pool)`
conditions	`iam_permission` `service_state`
state logic	ACTIVE when the dedicated SQL pool is in Running state; CONDITIONAL(service_state) when the pool is paused. Synapse SQL Administrator is a SQL-only role; it does NOT grant Synapse RBAC data-plane access to pipelines, Spark pools, linked services, or other workspace artifacts — only SQL db_owner on dedicated pools.

source type

Identity

target type

Data

source

<principal>

target

<dedicated SQL pool (DataWarehouse)>

permissions

Synapse RBAC: Synapse SQL Administrator (db_owner on dedicated SQL pool)

conditions

iam_permission service_state

state logic

ACTIVE when the dedicated SQL pool is in Running state; CONDITIONAL(service_state) when the pool is paused. Synapse SQL Administrator is a SQL-only role; it does NOT grant Synapse RBAC data-plane access to pipelines, Spark pools, linked services, or other workspace artifacts — only SQL db_owner on dedicated pools.

Narrative

{principal.name} has Synapse SQL Administrator role; has db_owner on dedicated SQL pool {target.name} and can read all data via SQL queries.

Raw rule rules/derived/azure/synapse.yaml

id: azure-synapse-sql-admin-data-read
emits: CanReadData
description: "Synapse SQL Administrator (distinct from Synapse Administrator) grants SQL-admin (db_owner)\
  \ on ALL dedicated SQL pools \u2014 a legitimate, narrowly-scoped role for SQL DBAs."
match:
- - principal: null
  - HasRole
  - <Synapse SQL Administrator role on workspace>
where:
- "Synapse RBAC role: Synapse SQL Administrator at workspace scope \u2014 grants db_owner on all dedicated\
  \ SQL pools only"
emit:
  source_type: Identity
  target_type: Data
  source: <principal>
  target: <dedicated SQL pool (DataWarehouse)>
  permissions:
  - 'Synapse RBAC: Synapse SQL Administrator (db_owner on dedicated SQL pool)'
  conditions:
  - iam_permission
  - service_state
  state_logic: "ACTIVE when the dedicated SQL pool is in Running state; CONDITIONAL(service_state) when\
    \ the pool is paused. Synapse SQL Administrator is a SQL-only role; it does NOT grant Synapse RBAC\
    \ data-plane access to pipelines, Spark pools, linked services, or other workspace artifacts \u2014\
    \ only SQL db_owner on dedicated pools."
  false_positive_note: 'Synapse SQL Administrator is DISTINCT from Synapse Administrator. SQL Admin has
    narrower scope: db_owner on SQL pools only, no other Synapse privileges. Do NOT equate with Synapse
    Administrator. SQL access requires the pool to be Running and either AAD or SQL authentication via
    the AAD admin (if azureADOnlyAuthentications is enabled, SQL auth is blocked). Network access (firewall/private
    endpoint) is a separate condition.'
  narrative: '{principal.name} has Synapse SQL Administrator role; has db_owner on dedicated SQL pool
    {target.name} and can read all data via SQL queries.'