> For the complete documentation index, see [llms.txt](https://docs.forestall.io/fsprotect/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/fsprotect/edges/azure/az_assigned_managed_identity.md). # AZ\_ASSIGNED\_MANAGED\_IDENTITY ## Summary | | | | ------------------------------ | ---------------------------------------------------------------------------------------- | | **FSProtect ACL Alias** | AZ\_ASSIGNED\_MANAGED\_IDENTITY | | **Azure Alias** | Assigned Managed Identity | | **Affected Object Types** | Azure resources with assigned managed identities -> Service Principal (Managed Identity) | | **Edge Direction** | Azure Resource -> Managed Identity Service Principal | | **Exploitation Certainty** | Certain | | **Exploitation Preconditions** | Requires a separate edge that gives control of the Azure resource runtime or workflow. | ## Description `AZ_ASSIGNED_MANAGED_IDENTITY` represents the relationship where an Azure resource has an assigned managed identity (system-assigned or user-assigned). The managed identity is backed by a Service Principal in Microsoft Entra ID, and the Azure resource authenticates as that Service Principal. There are two types of managed identities: * **System-assigned managed identity (SMI)** - Created automatically when enabled on the resource. Its lifecycle is tied to the resource; deleting the resource deletes the identity. The service principal name matches the resource name. * **User-assigned managed identity (UMI)** - Created as a standalone Azure resource and explicitly assigned to one or more Azure resources. Its lifecycle is independent of the resources it is assigned to. This edge is critical for attack paths because: * This edge does **not** grant execution by itself; it connects a controlled Azure resource to the managed identity Service Principal it can authenticate as. * If another edge gives control of the resource runtime, the resulting impact is determined by the managed identity's downstream permissions. * Managed identities are frequently over-provisioned with permissions such as Contributor, Owner, or broad Microsoft Graph API roles. ## Identification Identify this edge by finding Azure resources with a populated `identity` block. System-assigned identities expose a `principalId` directly on the resource. User-assigned identities appear as resource IDs under `userAssignedIdentities`; resolve those IDs to the corresponding user-assigned managed identity resource to get its Service Principal object. ### PowerShell (Az Module) ```powershell Connect-AzAccount # List all ARM resources with an identity block Get-AzResource -ExpandProperties | Where-Object { $_.Identity -and $_.Identity.Type } | Select-Object Name, ResourceGroupName, ResourceType, ResourceId, @{N='IdentityType';E={$_.Identity.Type}}, @{N='PrincipalId';E={$_.Identity.PrincipalId}}, @{N='UserAssignedIdentityIds';E={ if ($_.Identity.UserAssignedIdentities) { ($_.Identity.UserAssignedIdentities.PSObject.Properties.Name -join ', ') } }} | Format-Table -AutoSize # Resolve user-assigned managed identity resources Get-AzUserAssignedIdentity | Select-Object Name, ResourceGroupName, Location, ClientId, PrincipalId, Id | Format-Table -AutoSize ``` ### Azure CLI ```bash # List all ARM resources with an identity block az resource list \ --query "[?identity != null].{Name:name, Type:type, RG:resourceGroup, IdentityType:identity.type, PrincipalId:identity.principalId, UserAssignedIdentities:identity.userAssignedIdentities}" \ -o table # Resolve user-assigned managed identity resources az identity list \ --query "[].{Name:name, RG:resourceGroup, ClientId:clientId, PrincipalId:principalId, Id:id}" \ -o table ``` ### Azure Portal 1. Open **Azure Portal** and navigate to any Azure resource type that supports managed identities. 2. Under **Settings**, select **Identity**. 3. Check the **System assigned** tab for the SMI status and Object ID. 4. Check the **User assigned** tab for any attached UMIs. 5. For a UMI, open the linked managed identity resource to review its Client ID, Object ID, assignments, and activity. ## Exploitation ### Edge Chaining `AZ_ASSIGNED_MANAGED_IDENTITY` is a bridge edge, not a standalone exploitation primitive. Read it as: 1. A resource-control edge reaches the Azure resource. 2. This edge maps that resource to its managed identity Service Principal. 3. Downstream permission edges determine what that Service Principal can access. ### Common Inbound Edges These edges contain the resource-side exploitation details and should reference this edge when the target resource has a managed identity: | Edge | How it connects to this edge | | -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | [AZ\_EXECUTE\_COMMAND](https://docs.forestall.io/fsprotect/edges/azure/az_execute_command) | Command execution on VMs, VMSS, AKS, App Services, and Function Apps can become access as the resource identity. | | [AZ\_RDP](https://docs.forestall.io/fsprotect/edges/azure/az_rdp) | RDP access to Windows VMs can reach a VM's assigned managed identity when the VM is configured for Entra login. | | [AZ\_SSH](https://docs.forestall.io/fsprotect/edges/azure/az_ssh) | SSH access to Linux VMs can reach a VM's assigned managed identity when the VM is configured for Entra login. | | [AZ\_VM\_ADMIN\_LOGIN](https://docs.forestall.io/fsprotect/edges/azure/az_vm_admin_login) | Administrator login is the broad VM login edge that fans out to RDP or SSH and depends on the VM's system-assigned managed identity. | | [AZ\_SQL\_ADMIN](https://docs.forestall.io/fsprotect/edges/azure/az_sql_admin) | SQL admin control can pair with a SQL Server managed identity when the server identity has useful downstream permissions. | | [AZ\_AUTOMATION\_CONTRIBUTOR](https://docs.forestall.io/fsprotect/edges/azure/az_automation_contributor) | Runbooks execute as the Automation Account identity or Run As account. | | [AZ\_LOGIC\_APP\_CONTRIBUTOR](https://docs.forestall.io/fsprotect/edges/azure/az_logic_app_contributor) | Logic App workflow control can execute actions using the Logic App managed identity. | | [AZ\_WEBSITE\_CONTRIBUTOR](https://docs.forestall.io/fsprotect/edges/azure/az_website_contributor) | App Service and Function App control can reach the app's managed identity through deployment, SSH, Kudu, or code execution paths. | | [AZ\_LIST\_CLUSTER\_ADMIN\_CREDENTIALS](https://docs.forestall.io/fsprotect/edges/azure/az_list_cluster_admin_credentials) | AKS cluster-admin access can reach node or kubelet managed identity paths. | ### Common Outbound Edges After the graph reaches the managed identity Service Principal, evaluate the same privilege edges used for any other Service Principal: | Edge | What to evaluate | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | | [AZ\_HAS\_ARM\_ROLE](https://docs.forestall.io/fsprotect/edges/azure/az_has_arm_role) | Whether the managed identity holds an Azure RBAC role. | | [AZ\_ARM\_ROLE\_SCOPED\_TO](https://docs.forestall.io/fsprotect/edges/azure/az_arm_role_scoped_to) | The subscription, resource group, or resource scope where that RBAC role applies. | | [AZ\_ARM\_OWNER](https://docs.forestall.io/fsprotect/edges/azure/az_arm_owner) | Owner impact, including role assignment capability. | | [AZ\_CONTRIBUTOR](https://docs.forestall.io/fsprotect/edges/azure/az_contributor) | Broad resource-management impact without role assignment capability. | | [AZ\_VM\_CONTRIBUTOR](https://docs.forestall.io/fsprotect/edges/azure/az_vm_contributor) | VM-specific control that can loop back into execution paths. | | [AZ\_KEY\_VAULT\_CONTRIBUTOR](https://docs.forestall.io/fsprotect/edges/azure/az_key_vault_contributor) | Key Vault management-plane control that may enable data-plane access. | | [AZ\_GET\_SECRETS](https://docs.forestall.io/fsprotect/edges/azure/az_get_secrets), [AZ\_GET\_KEYS](https://docs.forestall.io/fsprotect/edges/azure/az_get_keys), [AZ\_GET\_CERTIFICATES](https://docs.forestall.io/fsprotect/edges/azure/az_get_certificates) | Direct Key Vault data-plane permissions. | | [AZ\_MG\_DANGEROUS\_PERMISSION](https://docs.forestall.io/fsprotect/edges/azure/az_mg_dangerous_permission) | High-risk Microsoft Graph application permissions assigned to the managed identity Service Principal. | | [AZ\_IN\_GROUP](https://docs.forestall.io/fsprotect/edges/azure/az_in_group) | Group membership that may grant inherited ARM, directory, or application privileges. | ## Mitigation 1. **Apply least-privilege to managed identities** * Audit permissions assigned to all managed identity service principals. * Remove unnecessary Azure RBAC roles and Microsoft Graph permissions. 2. **Use user-assigned managed identities deliberately** * UMIs can be centrally managed and audited, but shared high-privilege UMIs increase blast radius. * Prefer workload-specific UMIs where lifecycle and auditability matter. * Avoid assigning one broad UMI to many unrelated resources. 3. **Restrict code execution on resources** * Limit who can run commands on VMs (restrict VM Contributor, Contributor, Owner roles). * Limit SQL admin access to trusted principals only. 4. **Monitor managed identity sign-in activity** * Review Microsoft Entra sign-in logs for managed identity service principals. 5. **Disable managed identities when not needed** * If a resource does not require a managed identity, do not enable one. ## Detection Use the Azure Portal and Microsoft Entra admin center: 1. Open **Microsoft Entra ID** -> **Sign-in logs**. 2. Filter for service principal sign-ins where the service principal type is **Managed Identity**. 3. Review **Service principal**, **Resource**, **IP address**, **Date**, and **Status** for unexpected managed identity usage. 4. In **Azure Portal**, open **Monitor** -> **Activity log** and filter for operations initiated by the managed identity service principal. 5. Open the target resource and review **Identity**, **Access control (IAM)**, and related access settings to confirm the managed identity is expected. ## References * * * * *