Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
User Administrator role in B2C tenant can reset B2C consumer account passwords, enabling account takeover.
A principal with IdentityProvider.ReadWrite.All or Global Admin can inject a malicious external IdP into a B2C user flow.
Pool startTask / job env settings / resource-file SAS URLs frequently embed secrets, readable at Reader level.
Attach a privileged user-assigned MI to a controlled/new pool, add a startTask, and execute as the MI.
Batch account data-plane endpoint reachable by any key/token holder unless restricted to private endpoints.
Shared key -> data-plane task submit on an identity-bearing pool => execute as the pool MI.
Modify a pool startTask/config + the pool runs as an MI => execute as that MI (via IMDS).
Submit a data-plane task + the pool runs as an MI => execute as that MI (via IMDS).
A Batch pool that bears a user-assigned MI leaks that MI's credential to any code on its nodes via IMDS.
Any code on a Batch node can mint a bearer token for each pool user-assigned MI via IMDS.
Submit a job/task whose commandLine runs on pool nodes.
A blueprint definition containing a role-assignment artifact grants RBAC at the deployment scope when the assignment executes - the assigner effectively controls who gets RBAC at that scope.
The search service exposes its primary and secondary admin API keys (discoverable via listAdminKeys/action by principals holding Search Service Contributor, Contributor, or Owner roles). Admin keys grant full data-plane control of the search service (all indexes, indexers, data sources, and queries).
The search service exposes one or more query API keys (discoverable via listQueryKeys/action by principals holding Search Service Contributor, Contributor, or Owner roles). Query keys grant read-only data-plane access (search, suggest, autocomplete queries against all indexes).
A principal that can obtain an admin or query key (via ExposesCredential) can issue search, suggest, and autocomplete queries against all indexes in the service, reading the full content of matching indexed documents.
A principal with Search Index Data Reader or Search Index Data Contributor RBAC (Entra role) can query the search service indexes via Entra-authenticated access, without requiring API keys. This path bypasses the disableLocalAuth gate and credential extraction entirely.
Attach a privileged user-assigned MI to a controlled/new app or job, run it, and execute as the MI.
Exec into a running replica + the app runs as an MI => execute as that MI (read the identity endpoint from the shell).
Executing code in a custom-container session that binds a reachable MI => execute as that MI (read the identity endpoint from the session).
Control-plane image/command replacement + the app runs as an MI => execute as that MI (via the identity endpoint).
Container App with external ingress and no denying IP restrictions.
Attacker-controlled code in a container can mint a bearer token for each reachable bound managed identity via the local identity endpoint.
Executing code in a custom-container session pool runs attacker-supplied code in the sandbox; if the pool binds a reachable MI this is a CanExecuteAs primitive identical to the app exec path.