azure-vmss-mi-enter-subscription
Executing as the fleet MI grants whatever RBAC that MI holds.
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
?mi has an effective role assignment (e.g. Contributor/Owner) at subscription or RG scope
emit
| source type | Identity |
|---|---|
| target type | Subscription |
| source | <principal> |
| target | <subscription> |
| permissions | (inherited from MI's role assignments) |
Narrative
{principal.name}, by executing as {mi.name}, inherits its subscription-scoped RBAC and gains control-plane access to {subscription.name}.
Raw rule rules/derived/azure/vmss.yaml
id: azure-vmss-mi-enter-subscription
emits: CanEnterSubscription
description: Executing as the fleet MI grants whatever RBAC that MI holds.
match:
- - principal: null
- CanExecuteAs
- mi: null
where:
- ?mi has an effective role assignment (e.g. Contributor/Owner) at subscription or RG scope
emit:
source_type: Identity
target_type: Subscription
source: <principal>
target: <subscription>
permissions:
- (inherited from MI's role assignments)
note: If the fleet MI holds Owner or User Access Administrator, executing as it also yields CanGrantPermission/CanModifyPolicy
(Microsoft.Authorization/roleAssignments/write) - self-grant to any role at that scope, the highest-impact
continuation. If the MI holds Entra directory roles or Graph app roles it can further reach CanEnterTenant.
Those onward edges are produced by the identity ruleset (cross-reference it) rather than here, so
this chain is not silently truncated at subscription scope.
false_positive_note: Only emit if the MI actually holds RBAC at sub/RG scope; a scoped MI with only
data-plane access does not grant subscription entry.
narrative: '{principal.name}, by executing as {mi.name}, inherits its subscription-scoped RBAC and gains
control-plane access to {subscription.name}.'