Derivation rules

Any code running on a host that has a managed identity bound can obtain a bearer token for that MI from the IMDS (or App Service identity) endpoint with no Entra credential.

Synthesize an IMDS bearer token node for each host+MI pair where the host executes as the MI.

Principal with read permission on the MI ARM resource can enumerate its metadata (clientId, principalId, tenantId) - recon aiding IMDS multi-MI token requests.

An attacker who can start a stopped host can then retrieve IMDS tokens for its bound MI.

An IMDS bearer token minted from a host+MI pair is valid authentication as that MI.

A policy assignment with a system-assigned managed identity produces an ExecutesAs edge: remediation tasks run as that system MI. Extracted from the assignment's identity.principalId field.

A policy assignment with one or more user-assigned managed identities produces ExecutesAs edges for each. Extracted from the assignment's identity.userAssignedIdentities map (keys are MI resource IDs).

An Azure Policy remediation task (modeled as BuildWorker - the ARM deployment runner) executes as the managed identity bound in the policy assignment's identity block. Zero-cost structural fact; can-execute-as execute-as-via-code-modify and cicd-chains cicd-modify-buildspec-executes-as consume this to produce CanExecuteAs.

Attach a user-assigned MI to the workspace (workspaces/write + assign/action); all Spark jobs and pipelines then run as both the system-assigned MI and the newly attached user-assigned MI.

Attach a privileged user-assigned MI to the workspace (CanAttachIdentity) + workspace gains a new ExecutesAs target -> all Spark/pipeline runs can mint tokens for the attached MI.

Publish a pipeline with attacker code (CanModifyCode on workspace) + trigger it (CanTrigger) + workspace ExecutesAs MI => execute as workspace MI. Cites cicd-chains.yaml cicd-modify-buildspec-executes-as and can-execute-as.yaml.

Synapse Compute Operator submits a Spark batch job via Livy API (CanExecuteCommand) + Spark pool runs as workspace MI (ExecutesAs) => execute attacker code as the workspace MI.

Any code running on Synapse Spark/pipeline compute can mint a bearer token for the workspace MI via IMDS.

A Synapse linked service that stores credentials as plaintext (SQL auth password, storage key, SAS token) exposes those credentials to any principal with Synapse Linked Data Manager or Synapse Administrator role.

The Synapse workspace exposes the workspace managed identity credential to all Spark jobs and pipeline activities via IMDS (169.254.169.254).

Exec into a pod (cluster RBAC / credential / run-command) inherits the pod's mounted ServiceAccount/IRSA/Workload-Identity token, executing as that identity.

Reading a credential that is credentials for an identity yields the ability to authenticate as that identity.

Reading a secret that is credentials for an identity yields the ability to authenticate as that identity.

Signing tokens as an identity yields impersonation when a downstream trust validates those signatures.