Derivation rules
2,433 declarative match → where → emit rules
(1,787 derived, 646 explicit).
Filter by cloud, emitted edge, node type, or text.
A subscription associated/transferred to a different Entra tenant is a boundary-crossing trust (rare, privileged).
A principal that controls or administers a subscription has a control-plane foothold inside it.
A principal who can delete the owning Blueprint/Managed-App or remove a deny-effect policy assignment can lift the guardrail suppressing inherited control edges.
A principal who can move a resource/RG/subscription out of a guardrail's scope escapes the deny assignment without editing it.
Owner at a subscription or resource group controls that boundary (full actions incl. RBAC assignment).
User Access Administrator (or RBAC Administrator) at a scope can assign itself Owner - role-assignment privesc.
A Static Web App exposes its deployment token as a credential for the CI/CD pipeline identity.
Retrieve the SWA deployment token (AZURE_STATIC_WEB_APPS_API_TOKEN) via listSecrets/action.
Repoint SWA's source repository to an attacker-controlled repo, modifying build code.
A holder of the SWA deployment token can modify the build runner's deployment when a runner with a service identity exists.
Attach a user-assigned MI to the workspace (workspaces/write + assign/action); all Spark jobs and pipelines then run as both the system-assigned MI and the newly attached user-assigned MI.
bigDataPools/write allows uploading custom library packages to a Spark pool; those libraries execute on Spark workers running as the workspace MI.
Synapse Artifact Publisher role allows creating schedule/event/tumbling-window triggers that repeatedly run pipelines - persistence mechanism for code execution as the workspace MI.
Attach a privileged user-assigned MI to the workspace (CanAttachIdentity) + workspace gains a new ExecutesAs target -> all Spark/pipeline runs can mint tokens for the attached MI.
Synapse workspace development, SQL, and Spark endpoints are public-internet reachable when publicNetworkAccess is Enabled and no private-endpoint-only restriction is applied.
Retrieve IR auth key (CanReadSecret) + register a self-hosted IR node the attacker controls -> that node executes pipeline activities as the workspace MI. No generic linchpin covers this path; rule is Synapse-specific.
Upload malicious library to a Spark pool (CanModifyCode) + the pool runs as the workspace MI (ExecutesAs) => execute code as the workspace MI. Cites can-execute-as.yaml execute-as-via-code-modify.
Publish a pipeline with attacker code (CanModifyCode on workspace) + trigger it (CanTrigger) + workspace ExecutesAs MI => execute as workspace MI. Cites cicd-chains.yaml cicd-modify-buildspec-executes-as and can-execute-as.yaml.
Synapse Compute Operator submits a Spark batch job via Livy API (CanExecuteCommand) + Spark pool runs as workspace MI (ExecutesAs) => execute attacker code as the workspace MI.
Any code running on Synapse Spark/pipeline compute can mint a bearer token for the workspace MI via IMDS.
integrationRuntimes/listAuthKeys/action or regenerateAuthKey/action returns keys that can register a self-hosted IR node, giving that node persistent pipeline-execution foothold.
integrationRuntimes/write allows creating or updating integration runtimes; self-hosted IR configuration can point to attacker-controlled infrastructure, causing all pipeline activities routed through that IR to execute on attacker infrastructure.
A Synapse linked service that stores credentials as plaintext (SQL auth password, storage key, SAS token) exposes those credentials to any principal with Synapse Linked Data Manager or Synapse Administrator role.
Synapse Artifact Publisher role allows publishing pipelines with arbitrary Spark/custom/web activities; the workspace Workflow node executes them as the workspace MI.
Synapse Compute Operator role allows triggering pipeline runs (createPipelineRun) on the workspace, executing whatever pipeline definition is currently published.
CREATE EXTERNAL TABLE AS SELECT (CETAS) on the serverless SQL pool exports query results to an external storage location; if the workspace MI holds write access on attacker-controlled storage, data is exfiltrated.
Serverless SQL pool allows querying ADLS Gen2 files directly via OPENROWSET; Synapse Administrator has db_owner (dbo) on the built-in serverless pool and can read any data the workspace MI can reach.
workspaces/administrators/write allows setting the AAD administrator on the workspace, effectively granting that principal Synapse Administrator-equivalent data-plane access.
Synapse Compute Operator can submit Spark batch jobs and interactive sessions directly via the Apache Livy REST API endpoint at <workspace>.dev.azuresynapse.net/livyApi/..., triggering immediate job execution.
Synapse Compute Operator role (or Synapse Administrator) allows submitting Spark batch jobs and interactive sessions via the Livy API, running attacker-supplied code on Spark workers.
Synapse SQL Administrator (distinct from Synapse Administrator) grants SQL-admin (db_owner) on ALL dedicated SQL pools - a legitimate, narrowly-scoped role for SQL DBAs.
Synapse Administrator (or db_owner in the dedicated SQL pool) can query all data in the dedicated SQL pool.
ARM Contributor/Owner on the Synapse workspace grants full control: create/delete pools, update settings, manage linked services, set AAD admin.
The Synapse workspace exposes the workspace managed identity credential to all Spark jobs and pipeline activities via IMDS (169.254.169.254).
workspaces/write allows changing the workspace identity block (attach/detach user-assigned MI), firewall rules, AAD admin, and integration runtime config - all alter execution identity or reach.
Attach a privileged user-assigned MI to an existing VM the caller can run code on, then execute as that MI via IMDS.
Command/code execution on a VM + the VM runs as an MI => execute as that MI (via IMDS).
VM with a public IP and an NSG rule allowing an inbound port.
A VM bound to a managed identity leaks that identity's credential via the IMDS token endpoint (the exposure fact paired with azure-vm-imds-token).
Any code on a VM can mint a bearer token for each bound managed identity via IMDS.