Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
A Function app with a public hostname and an anonymous-auth HTTP trigger.
Create a new Function app bound to a passable user-assigned MI, deploy code, execute as the MI.
Code modification on a Function app + the app runs as an MI => execute as that MI (via the identity endpoint).
Config modification (run-from-package / image / startup) + ExecutesAs => execute as the MI.
Master/host key -> admin runtime API to overwrite+run code as the MI.
Publishing (SCM/Kudu/FTP) credentials -> push code -> execute as the MI.
The admin runtime action can add/replace/delete functions, not just invoke them -> code modification.
Invoke an HTTP-triggered function using a held key (or anonymously).
A Function app with a bound MI leaks that MI's credential to any code running in the app via the App Service identity endpoint.
Any code in a Function app can mint a bearer token for each bound MI via the App Service identity endpoint.
Function app SCM/app surface reachable publicly (used with a held key or exploitable code).
Swap a controlled slot into a higher-privilege slot -> the swapped-in code runs under the target slot's (more privileged) managed identity.
Owner/Contributor/Key Vault Contributor (control-plane vaults/write) fully controls the vault object.
Key Vault Administrator (data-plane vaults/* dataAction) fully controls the vault data plane.
Key Vault Administrator over the vault yields read/decrypt/sign on every object in it.
Key Vault Administrator can decrypt/unwrap with every key in the vault.
Key Vault Administrator can sign with every signing-capable key in the vault.
Contributor/Key Vault Contributor self-adds an access policy to gain data-plane access (access-policy model only).
CanDecrypt on the wrapping KV key completes CanReadData on an externally-stored, CMK-wrapped store.
Public-network + Allow-default firewall exposes the data plane tenant-wide (still Entra-authz).