Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
A managing-tenant ExternalPrincipal named in a subscription-scoped Lighthouse authorization has CanEnterSubscription into the customer subscription.
A managing-tenant principal delegated User Access Administrator (with allowDelegatedRoleAssignments: true) can assign roles in the customer subscription - subscription-scoped CanGrantPermission.
A Microsoft Entra Global Administrator can call elevateAccess to gain User Access Administrator at root scope (/), controlling the root management group and thus every subscription in the tenant.
Ability to write Azure Policy assignments/definitions at a management group scope lets a principal weaken or remove a deny-effect guardrail inherited by the subtree.
Moving a subscription under a management group where the attacker is Owner makes the attacker's MG-scoped RBAC inherit down and take over the subscription.
Owner at a management group scope administers that boundary; feeds can-control -> Controls -> subtree descent.
Management-group write lets a principal reparent a subscription / child MG (move it into or out of an MG), altering which RBAC and guardrails it inherits.
Ability to assign RBAC at a management group scope (Owner / User Access Administrator) is a boundary-scoped self-grant over the whole subtree.
A self-grant of a crypto role (via roleAssignments/write) is privilege escalation to key usage.
Any Managed HSM local role that carries roleAssignments/write can assign any local role, including to itself.
A Managed HSM local Crypto User role can decrypt/unwrap with an HSM key.
A Managed HSM local Crypto User role can sign with an HSM signing key.
A wrapped store whose wrapping key the principal can decrypt exposes the credential it holds.
A guest/foreign-tenant principal granted a Managed HSM local role gains cross-tenant crypto access.
A holder of keys/release/action (Crypto User or Crypto Service Release User) can export an exportable HSM key via Secure Key Release.
Possession of the security domain + quorum keys can clone all HSM keys to a new pool.
Signing with an HSM key that backs a token/cert issuer lets the caller sign as that identity.
Principal with full control of the MI ARM object (Managed Identity Contributor / Contributor / Owner at scope) can administer the user-assigned identity resource.
A host with a bound MI exposes that identity's bearer token credential via the IMDS / App Service identity endpoint to any code running inside it.
Any code running on a host that has a managed identity bound can obtain a bearer token for that MI from the IMDS (or App Service identity) endpoint with no Entra credential.
Synthesize an IMDS bearer token node for each host+MI pair where the host executes as the MI.
Principal with read permission on the MI ARM resource can enumerate its metadata (clientId, principalId, tenantId) - recon aiding IMDS multi-MI token requests.
An attacker who can start a stopped host can then retrieve IMDS tokens for its bound MI.
An IMDS bearer token minted from a host+MI pair is valid authentication as that MI.
Delete an action group, silencing the response actions (email, SMS, webhook, Azure Function, Logic App, Automation Runbook) for ALL alert rules that reference it - a high-blast-radius evasion against automated incident response.