Derivation rules

A principal that can attach a policy to a permission set (via sso:PutInlinePolicyToPermissionSet or sso:AttachManagedPolicyToPermissionSet) widens the effective permissions of every current assignee of that permission set across all assigned accounts.

listKeys/action returns ADLS Gen2 account keys, bypassing all RBAC and ACLs.

Reading a secret that is a credential for a more-privileged identity is escalation.

A service principal holding User.ReadWrite.All (or Directory.ReadWrite.All) can reset any non-protected Entra user's password via PATCH /users/{id} with a new passwordProfile, taking over that user's account and inheriting their RBAC and group memberships.

An identity with ARM Contributor or Owner permission on a Microsoft.Purview/accounts resource is automatically granted the Purview Root Collection Admin role within the account at creation. This is an ARM control-plane to Purview data-plane escalation: ARM admin authority over the account resource carries over to data-plane administrative capability. Per Microsoft documentation, the account creator is assigned Root Collection Admin in Purview, enabling role assignment and privilege escalation within the Purview scope.

A principal is assigned the Purview Collection Admin role within a Purview account. Collection Admin allows managing collections and assigning Purview RBAC roles to other principals within the account (data-plane administrative capability).

A principal is assigned the Purview Data Curator role within a Purview account. Data Curator allows read and write access to catalog assets, classifications, and glossary terms (data-plane write access).

A principal is assigned the Purview Data Reader role within a Purview account. This assignment is visible via the Purview REST API policyElements endpoint and materializes an explicit HasRole edge (Identity -> Role). The principal can read catalog assets, classifications, and scan results (data-plane access).

A principal is assigned the Purview Data Source Administrator role. Data Source Admin manages scan credentials, data sources, and integration runtimes (data-plane operational capability, includes write permissions).

listKeys/action returns storage account keys, bypassing all Azure RBAC and network controls for all sub-services (when SharedKey auth is enabled).

An external CI system (GitHub Actions/GitLab CI/Azure DevOps) with an OIDC/WIF trust into a cloud role/SA can federate in as that identity; escalation roll-ups are federation-chains'.

Exec into a pod (cluster RBAC / credential / run-command) inherits the pod's mounted ServiceAccount/IRSA/Workload-Identity token, executing as that identity.

Federating into a Role homed in an AWS account gives the federated principal a foothold in that account.

Federating into a ServiceAccount homed in a GCP project gives the federated principal a foothold in that project.

A realized external->internal identity mapping whose trust condition an attacker-controlled external identity can satisfy yields federation into the internal identity.

Issuing a certificate from a CA that is the trust anchor of a federation lets the issuer mint a matching external identity and federate in.

A Kubernetes workload-identity binding (KSA<->GSA / IRSA / AKS Workload Identity) lets the pod's projected SA token federate into a cloud Role/ServiceAccount; escalation roll-ups are federation-chains'.