CanAddMember
Source can add a principal (itself) to a group/role and inherit its permissions.
Identity
── CanAddMember ──▸
Group, Role, ServiceIdentity
Source types
IdentityTarget types
States
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | explicit |
|---|
Per-cloud
| cloud | permissions / triggers | note |
|---|---|---|
| aws |
iam:AddUserToGroup
|
|
| gcp | - | Workspace group membership admin. |
| azure |
group member write (Graph / owner)
|
Rules that emit CanAddMember 6
awsderived
azurederived
A service principal holding Group.ReadWrite.All, GroupMember.ReadWrite.All, or Directory.ReadWrite.All can add any principal (including itself) to any Entra group, inheriting that group's RBAC role assignments, Graph app role assignments, and any other entitlements the group carries.
azurederived
Principal with cloudidentity.groups.memberships.create (or group Manager/Owner role) can add any principal - including itself - to the target group, inheriting its bound GCP IAM roles.
gcpderived
awsexplicit
awsexplicit