azure-synapse-workspace-write-config
workspaces/write allows changing the workspace identity block (attach/detach user-assigned MI), firewall rules, AAD admin, and integration runtime config - all alter execution identity or reach.
match (effective permission)
{
"action": "Microsoft.Synapse/workspaces/write",
"scope_type": "resource|resourceGroup|subscription"
}
emit
| source type | Identity |
|---|---|
| target type | AnalyticsService |
| source | <principal> |
| target | <Synapse workspace> |
| permissions | Microsoft.Synapse/workspaces/write |
Narrative
{principal.name} can rewrite the configuration of Synapse workspace {target.name} (workspaces/write), including its managed-identity block, firewall rules, and integration runtime settings.
Raw rule rules/derived/azure/synapse.yaml
id: azure-synapse-workspace-write-config
emits: CanModifyConfiguration
description: "workspaces/write allows changing the workspace identity block (attach/detach user-assigned\
\ MI), firewall rules, AAD admin, and integration runtime config \u2014 all alter execution identity\
\ or reach."
match_effective_permission:
action: Microsoft.Synapse/workspaces/write
scope_type: resource|resourceGroup|subscription
emit:
source_type: Identity
target_type: AnalyticsService
source: <principal>
target: <Synapse workspace>
permissions:
- Microsoft.Synapse/workspaces/write
false_positive_note: workspaces/write changes the ARM-level configuration; changing the identity block
to add a user-assigned MI also requires assign/action on that MI (see azure-synapse-attach-user-mi).
Firewall/IR changes are ACTIVE immediately. Identity changes take effect on the next job submission.
narrative: '{principal.name} can rewrite the configuration of Synapse workspace {target.name} (workspaces/write),
including its managed-identity block, firewall rules, and integration runtime settings.'