Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
beginGetAccess/action on a snapshot with AllowAll (default) network access policy mints an internet-routable anonymous SAS download URL.
beginGetAccess/action on a snapshot with AllowPrivate network access policy or publicNetworkAccess: Disabled mints a SAS URL accessible only via private endpoint.
snapshots/write allows setting publicNetworkAccess and networkAccessPolicy on a snapshot, enabling cross-subscription SAS download.
databases/export/action exports the full DB as a BACPAC to a caller-specified storage URL, enabling complete data exfiltration outside the tenant.
servers/administrators/write allows modifying the Entra admin assignment, which is equivalent to modifying the SQL access policy (who holds db_owner on all databases).
managedInstances/administrators/write allows modifying the Entra admin assignment on the MI, which is equivalent to modifying the SQL access policy (who holds db_owner on all MI databases).
servers/administrators/write lets a caller set any Entra identity (including themselves) as full DBA on all databases in the SQL server, yielding complete data-plane read and write if the SQL endpoint is network-reachable.
managedInstances/administrators/write lets a caller set any Entra identity (including themselves) as full DBA on all MI databases, yielding complete data-plane read and write if the MI endpoint is network-reachable.
backupLongTermRetentionPolicies/write allows redirecting SQL MI database backups to an attacker-controlled storage account, enabling full database exfiltration outside the tenant.
SQL Managed Instance with publicDataEndpointEnabled=true and an NSG allowing inbound TCP 3342 from the internet is reachable by any internet host.
Allow Azure services rule (startIp=endIp=0.0.0.0) exposes the SQL server to all Azure tenants and multi-tenant services - not public internet but broad cross-tenant exposure.
SQL logical server with publicNetworkAccess=Enabled and a 0.0.0.0–255.255.255.255 firewall rule is reachable from the public internet on port 1433.
Storage Blob Data Contributor/Owner at account scope grants blob write access to all containers.
Storage Blob Data Contributor/Owner at container scope grants blob write access to that specific container.
Storage Blob Data Reader/Contributor/Owner at account scope grants data-plane read of all blob containers.
Storage Blob Data Reader/Contributor/Owner at container scope grants data-plane read of a specific blob container.
Storage File Data SMB Share Reader/Contributor grants SMB file share read access - enabling lateral movement and credential capture via shared files.
generateUserDelegationKey/action returns user-delegation key material (not a pre-formed SAS token) - the caller can sign arbitrary user-delegation SAS URLs offline within the key's validity window.
listAccountSas/action generates a pre-formed account-level SAS token, providing scoped but key-equivalent data-plane access.
listKeys/action returns storage account keys, bypassing all Azure RBAC and network controls for all sub-services (when SharedKey auth is enabled).
Storage account with public blob access enabled and a public container exposes blob data to unauthenticated internet access.
Storage Queue Data Reader/Message Processor grants queue message read - messages may carry SAS tokens, connection strings, or other credentials.
Storage Queue Data Contributor/Message Processor grants queue message write - enabling message poisoning of queues consumed by Functions/Logic Apps with SYSTEM identity.
Storage Table Data Reader grants table entity read - table data may contain application credentials or sensitive configuration.
Contributor at a subscription/RG can create, modify, and delete resources under it, but cannot assign RBAC.