azure-synapse-workspace-contributor
ARM Contributor/Owner on the Synapse workspace grants full control: create/delete pools, update settings, manage linked services, set AAD admin.
match (effective permission)
{
"action": "Microsoft.Synapse/workspaces/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Contributor, Owner, or a custom role granting Microsoft.Synapse/workspaces/* at the scope
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <Synapse workspace> |
| permissions | Microsoft.Synapse/workspaces/write |
Narrative
{principal.name} has full ARM control of Synapse workspace {target.name} (Microsoft.Synapse/workspaces/write); can create/delete pools, update all settings, set AAD admin, and attach managed identities.
Raw rule rules/derived/azure/synapse.yaml
id: azure-synapse-workspace-contributor
emits: CanAdminister
description: 'ARM Contributor/Owner on the Synapse workspace grants full control: create/delete pools,
update settings, manage linked services, set AAD admin.'
match_effective_permission:
action: Microsoft.Synapse/workspaces/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Contributor, Owner, or a custom role granting Microsoft.Synapse/workspaces/*
at the scope
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <Synapse workspace>
permissions:
- Microsoft.Synapse/workspaces/write
false_positive_note: workspaces/write grants ARM control-plane management but does NOT by itself grant
Synapse RBAC data-plane roles (submit jobs, run pipelines, read linked services). Model BOTH planes
separately. An ARM Contributor who is not also a Synapse Administrator cannot submit Spark jobs without
adding themselves to the Synapse RBAC system. The CanAdminister edge captures that they can grant
themselves those roles via workspaces/administrators/write.
narrative: '{principal.name} has full ARM control of Synapse workspace {target.name} (Microsoft.Synapse/workspaces/write);
can create/delete pools, update all settings, set AAD admin, and attach managed identities.'