Derivation rules

Write auto-provisioning settings (Microsoft.Security/autoProvisioningSettings/write); disabling auto-provisioning prevents automatic deployment of the Log Analytics agent and Microsoft Defender for Endpoint on newly created or reimaged VMs and Arc-connected machines, leaving them unmonitored by Defender for Cloud.

Write the Defender pricing tier for a subscription (Microsoft.Security/pricings/write); setting any plan to 'Free' disables threat-detection for that resource type subscription-wide. This blinds Defender without altering any resource access controls.

Write Defender for Cloud security contacts (Microsoft.Security/securityContacts/write); removing or replacing email/phone recipients silences external alert notification delivery out-of-band from the Azure portal, reducing off-portal incident-response triggers.

Write workspace settings (Microsoft.Security/workspaceSettings/write); redirecting the Defender data pipeline to a different or non-existent workspace severs log collection and alert generation subscription-wide.

Create or modify a Defender for Cloud alert suppression rule (Microsoft.Security/ alertsSuppressionRules/write); suppressed alert types are auto-dismissed before analysts see them, reducing SOC visibility into the suppressed attack patterns.

A Key Vault-linked variable group exposes Azure Key Vault secrets to pipeline runs; the pipeline's service-connection identity must hold Key Vault Secrets User RBAC.

Write access to the CI-trigger branch of the pipeline's source repo lets a principal inject code that the pipeline will execute on the next triggered run.

DevOps 'Manage service endpoints' permission lets a principal bind a different - potentially more privileged - service connection to a pipeline, changing its execution identity.

An ARM service connection (secret-based) injects the backing SP's client secret / certificate into the job environment; pipeline code can read and exfiltrate it.

A principal that can CanExecuteAs the pipeline's service-connection identity, where that identity holds ARM Contributor/Owner at subscription scope, gains a foothold in that Azure subscription.

DevOps 'Manage service endpoints' permission lets a principal create a new service connection embedding a chosen Entra SP's credentials, enabling identity-swap escalation paths.

A pipeline stage that uses DownloadSecureFile@1 (or equivalent) materializes the secure file on the agent disk; pipeline code can read the certificate, SSH key, or credential file.

A self-hosted pipeline agent (VirtualMachine) runs as its OS user / managed identity, providing a second execution identity for all pipelines on that agent.

Write to a shared YAML template repo/branch that a pipeline imports via 'extends: template', injecting code into all downstream pipelines that use it.

A pipeline that references a non-Key Vault variable group has the group's secret variables injected into every job's environment; pipeline code can read and log them.

A WIF service connection lets a pipeline job request a short-lived Azure DevOps OIDC token that is then exchanged for an ARM access token; any code in the job can call the OIDC endpoint.

Wildcard permission on disks grants full control of the disk resource.

An attacker who can SAS-export a CMK-encrypted managed disk downloads encrypted VHD blobs; plaintext read requires decrypt on the wrapping DES key (CONDITIONAL). When the same principal also holds CanDecrypt on the DES Key Vault key the decrypt-gates-secret-read rule in credential-chains.yaml upgrades to ACTIVE.

An OS-type managed disk (Windows or Linux) is heuristically classified as containing credential material: SAM/NTDS hive, /etc/shadow, SSH private keys, or application credential files.

A principal with CanModifyConfiguration(DES) can upgrade a CONDITIONAL(key_permission) CanReadData edge to ACTIVE by pointing the DES at an attacker-controlled Key Vault key and triggering VM lifecycle (re-encrypt under attacker key on next attach/detach).

A disk that can be SAS-exported and contains secrets exposes those credentials as accessible to external parties. The state (ACTIVE vs CONDITIONAL) depends on the CanExfiltrate edge state.

An attacker who can SAS-export a PMK-encrypted or unencrypted managed disk can read the plaintext data immediately upon download (no key gate).

beginGetAccess/action on a disk with AllowAll (default) network access policy mints an internet-routable anonymous SAS download URL for the full VHD.

beginGetAccess/action on a disk with AllowPrivate network access policy mints a SAS download URL accessible only via the private endpoint.

disks/write allows changing networkAccessPolicy (e.g. from AllowPrivate to AllowAll), which upgrades CONDITIONAL(network_reachability) SAS-export edges to ACTIVE.

diskEncryptionSets/write allows changing the Key Vault key reference in a DES, enabling attacker-controlled key wrapping for re-encryption at next attachment.

A CNAME or A/AAAA alias DNS record in a public Azure DNS zone pointing to a deprovisioned Azure resource enables subdomain takeover: an external attacker can claim that resource name and inherit DNS resolution for the dangling hostname.

Write access to NS records in a public DNS zone lets an attacker replace the name-server delegation for the zone (or a sub-zone), routing all subsequent DNS queries through attacker-controlled authoritative nameservers - a higher-blast-radius attack than single-record modification.

Write access to record sets in a private Azure DNS zone (any record type) lets an attacker create or overwrite internal hostname records, redirecting resolution for internal service FQDNs (including private endpoint hostnames) to attacker-controlled private IPs within the VNet - enabling internal MitM or service impersonation.

Write access to VNet links on a private DNS zone lets an attacker add new VNet links, extending the zone's resolution scope to additional VNets - including VNets in other subscriptions within the same tenant - expanding the blast radius of any private DNS record modification.

Full administrative control over a private Azure DNS zone (Private DNS Zone Contributor or equivalent): the principal can manage all record types, zone settings, and VNet links.

Full administrative control over a public Azure DNS zone (DNS Zone Contributor or equivalent): the principal can manage all record types, zone settings, and zone-level RBAC delegation (where Owner scope is held).

Write access to record sets in a public Azure DNS zone (any record type via wildcard or specific-type write) lets an attacker create or overwrite A, CNAME, MX, or other records, redirecting hostnames under the zone to attacker-controlled infrastructure.

Modify the Capture configuration of an event hub (eventhubs/write) to redirect the Avro capture stream to an attacker-controlled storage account; all events are then captured to attacker storage.

Azure Event Hubs Data Receiver role (or equivalent) grants receive (listen) access to an event hub or consumer group; event payloads may contain sensitive data → potential CanExfiltrate.

Azure Event Hubs Data Sender role (or equivalent custom role) grants send (publish) access to an event hub; feeds messaging-chains trigger primitive.

Read SAS signing keys for an entity-level (event-hub) authorization rule via listkeys/action; keys are scoped to one event hub.

Read SAS signing keys for a namespace-level authorization rule via listkeys/action; the primary and secondary keys can forge SAS tokens for all event hubs in the namespace.

Full control of an Event Hubs namespace (Contributor / Owner / custom role with namespaces/write); subsumes send, receive, listkeys, and entity management.

An Event Hubs namespace with no IP/VNet network restrictions and publicNetworkAccess not Disabled is internet-reachable; any holder of SAS or Entra data-plane credentials can access it from the internet.