CanEnterSubscription
Source can gain control-plane access within the target subscription.
Identity
── CanEnterSubscription ──▸
Subscription
Derivation
| nature | derived |
|---|
Rules that emit CanEnterSubscription 8
A principal that can CanExecuteAs the pipeline's service-connection identity, where that identity holds ARM Contributor/Owner at subscription scope, gains a foothold in that Azure subscription.
azurederived
A secret credential for a principal in another subscription yields entry there.
azurederived
A managing-tenant ExternalPrincipal named in a subscription-scoped Lighthouse authorization has CanEnterSubscription into the customer subscription.
azurederived
A principal that controls or administers a subscription has a control-plane foothold inside it.
azurederived
Executing as the fleet MI grants whatever RBAC that MI holds.
azurederived
Control of a parent administrative boundary inherits transitively to every descendant boundary and resource via Contains*.
derived
Materialize a foothold identity inside a subscription/project/tenant/organization when a principal can impersonate/assume/federate into an identity homed there; escalate to Controls only when entry implies admin at a top boundary.
derived
azureexplicit