From 93db0e088979658edaa51024c9e87c6c4b43184b Mon Sep 17 00:00:00 2001 From: Martin Sohn Christensen Date: Wed, 19 Aug 2026 12:03:24 +0200 Subject: [PATCH 01/11] Visually separate lifecycle headlines --- docs/analyze-data/findings/table-view.mdx | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/analyze-data/findings/table-view.mdx b/docs/analyze-data/findings/table-view.mdx index 8b809645..859ccfc3 100644 --- a/docs/analyze-data/findings/table-view.mdx +++ b/docs/analyze-data/findings/table-view.mdx @@ -86,8 +86,8 @@ flowchart LR subgraph active["Active findings"] direction TB - open["Open
No active acceptance"] - accepted["Accepted
Risk acceptance is active"] + open["Open
No active acceptance"] + accepted["Accepted
Risk acceptance is active"] open -->|"Accept risk"| accepted accepted -->|"Remove or expire
acceptance"| open end @@ -98,9 +98,9 @@ flowchart LR subgraph archived["System-archived outcomes"] direction TB systemChange{"System change"} - remediated["Remediated
Analysis no longer detects the finding"] - orphaned["Orphaned
Environment or OpenGraph extension
archived or removed"] - deprecated["Deprecated
Finding type removed from the schema"] + remediated["Remediated
Analysis no longer detects the finding"] + orphaned["Orphaned
Environment or OpenGraph extension
archived or removed"] + deprecated["Deprecated
Finding type removed from the schema"] systemChange --> remediated systemChange --> orphaned systemChange --> deprecated From 5a7c3cb33796d60bf7f7483ef3da4420d0b99877 Mon Sep 17 00:00:00 2001 From: Martin Sohn Christensen Date: Wed, 26 Aug 2026 23:54:16 +0200 Subject: [PATCH 02/11] Standardize Entra ID and Azure RM documentation `descriptions` fields Ensure all AZ edge and node `description` fields are concise and platform-aware (if it applies to Microsoft Entra ID, Azure Resource Manager, or both) --- docs/resources/edges/az-add-members.mdx | 2 +- docs/resources/edges/az-add-owner.mdx | 2 +- docs/resources/edges/az-add-secret.mdx | 2 +- docs/resources/edges/az-aks-contributor.mdx | 2 +- docs/resources/edges/az-authenticates-to.mdx | 2 +- docs/resources/edges/az-automation-contributor.mdx | 2 +- docs/resources/edges/az-avere-contributor.mdx | 2 +- docs/resources/edges/az-contains.mdx | 2 +- docs/resources/edges/az-contributor.mdx | 2 +- docs/resources/edges/az-execute-command.mdx | 2 +- docs/resources/edges/az-get-certificates.mdx | 2 +- docs/resources/edges/az-get-keys.mdx | 2 +- docs/resources/edges/az-get-secrets.mdx | 2 +- docs/resources/edges/az-has-role.mdx | 2 +- docs/resources/edges/az-key-vault-contributor.mdx | 2 +- docs/resources/edges/az-logic-app-contributor.mdx | 2 +- docs/resources/edges/az-managed-identity.mdx | 2 +- docs/resources/edges/az-member-of.mdx | 2 +- docs/resources/edges/az-mg-add-member.mdx | 2 +- docs/resources/edges/az-mg-add-owner.mdx | 2 +- docs/resources/edges/az-mg-add-secret.mdx | 2 +- .../resources/edges/az-mg-app-role-assignment-readwrite-all.mdx | 2 +- docs/resources/edges/az-mg-application-readwrite-all.mdx | 2 +- docs/resources/edges/az-mg-directory-readwrite-all.mdx | 2 +- docs/resources/edges/az-mg-grant-app-roles.mdx | 2 +- docs/resources/edges/az-mg-grant-role.mdx | 2 +- docs/resources/edges/az-mg-group-member-readwrite-all.mdx | 2 +- docs/resources/edges/az-mg-group-readwrite-all.mdx | 2 +- .../edges/az-mg-role-management-readwrite-directory.mdx | 2 +- .../edges/az-mg-service-principal-endpoint-readwrite-all.mdx | 2 +- docs/resources/edges/az-node-resource-group.mdx | 2 +- docs/resources/edges/az-owns.mdx | 2 +- docs/resources/edges/az-reset-password.mdx | 2 +- docs/resources/edges/az-role-approver.mdx | 2 +- docs/resources/edges/az-role-eligible.mdx | 2 +- docs/resources/edges/az-runs-as.mdx | 2 +- docs/resources/edges/az-scoped-to.mdx | 2 +- docs/resources/edges/az-user-access-administrator.mdx | 2 +- docs/resources/edges/az-vm-admin-login.mdx | 2 +- docs/resources/edges/az-vm-contributor.mdx | 2 +- docs/resources/edges/az-website-contributor.mdx | 2 +- docs/resources/nodes/az-app.mdx | 1 + docs/resources/nodes/az-automation-account.mdx | 1 + docs/resources/nodes/az-base.mdx | 1 + docs/resources/nodes/az-container-registry.mdx | 1 + docs/resources/nodes/az-device.mdx | 1 + docs/resources/nodes/az-federated-identity-credential.mdx | 2 +- docs/resources/nodes/az-function-app.mdx | 1 + docs/resources/nodes/az-group.mdx | 1 + docs/resources/nodes/az-key-vault.mdx | 1 + docs/resources/nodes/az-logic-app.mdx | 1 + docs/resources/nodes/az-managed-cluster.mdx | 1 + docs/resources/nodes/az-management-group.mdx | 1 + docs/resources/nodes/az-resource-group.mdx | 1 + docs/resources/nodes/az-role.mdx | 1 + docs/resources/nodes/az-service-principal.mdx | 1 + docs/resources/nodes/az-subscription.mdx | 1 + docs/resources/nodes/az-tenant.mdx | 1 + docs/resources/nodes/az-user.mdx | 1 + docs/resources/nodes/az-vm-scale-set.mdx | 1 + docs/resources/nodes/az-vm.mdx | 1 + docs/resources/nodes/az-web-app.mdx | 1 + 62 files changed, 62 insertions(+), 42 deletions(-) diff --git a/docs/resources/edges/az-add-members.mdx b/docs/resources/edges/az-add-members.mdx index 81d2dda2..cd76ec8c 100644 --- a/docs/resources/edges/az-add-members.mdx +++ b/docs/resources/edges/az-add-members.mdx @@ -1,6 +1,6 @@ --- title: AZAddMembers -description: "The ability to add other principals to an Azure security group" +description: "The ability to add principals to a security group in Microsoft Entra ID." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-add-owner.mdx b/docs/resources/edges/az-add-owner.mdx index fa6eea5c..3406da6f 100644 --- a/docs/resources/edges/az-add-owner.mdx +++ b/docs/resources/edges/az-add-owner.mdx @@ -1,6 +1,6 @@ --- title: AZAddOwner -description: "This edge is created during post-processing." +description: "This edge is created during post-processing to represent ownership over an object in Microsoft Entra ID." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-add-secret.mdx b/docs/resources/edges/az-add-secret.mdx index 0557fcdb..2e2fb40d 100644 --- a/docs/resources/edges/az-add-secret.mdx +++ b/docs/resources/edges/az-add-secret.mdx @@ -1,6 +1,6 @@ --- title: AZAddSecret -description: Azure provides several systems and mechanisms for granting control of securable objects within Entra ID, including tenant-scoped admin roles, object-scoped admin roles, explicit object ownership, and API permissions. +description: "Azure provides several systems and mechanisms for granting control of securable objects within Entra ID, including tenant-scoped admin roles, object-scoped admin roles, explicit object ownership, and API permissions." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-aks-contributor.mdx b/docs/resources/edges/az-aks-contributor.mdx index c2d8de58..949cae4b 100644 --- a/docs/resources/edges/az-aks-contributor.mdx +++ b/docs/resources/edges/az-aks-contributor.mdx @@ -1,6 +1,6 @@ --- title: AZAKSContributor -description: "The Azure Kubernetes Service Contributor role grants full control of the target Azure Kubernetes Service Managed Cluster." +description: "The Azure Kubernetes Service Contributor role in Azure Resource Manager grants full control of the target Azure Kubernetes Service managed cluster." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-authenticates-to.mdx b/docs/resources/edges/az-authenticates-to.mdx index 08f24618..132b8778 100644 --- a/docs/resources/edges/az-authenticates-to.mdx +++ b/docs/resources/edges/az-authenticates-to.mdx @@ -1,6 +1,6 @@ --- title: AZAuthenticatesTo -description: The AZAuthenticatesTo edge indicates that a Federated Identity Credential (FIC) is configured on an Azure App Registration, allowing an external identity provider to authenticate as the application without a password or certificate. +description: "The AZAuthenticatesTo edge indicates that a Federated Identity Credential (FIC) is configured on an application registration in Microsoft Entra ID, allowing an external identity provider to authenticate as the application without a password or certificate." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-automation-contributor.mdx b/docs/resources/edges/az-automation-contributor.mdx index 7647ee23..eb3a8a46 100644 --- a/docs/resources/edges/az-automation-contributor.mdx +++ b/docs/resources/edges/az-automation-contributor.mdx @@ -1,6 +1,6 @@ --- title: AZAutomationContributor -description: The Azure Automation Contributor role grants full control of the target Azure Automation Account. This includes the ability to execute arbitrary commands on the Automation Account. +description: "The Azure Automation Contributor role in Azure Resource Manager grants full control of the target Azure Automation account. This includes the ability to execute arbitrary commands on the Automation account." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-avere-contributor.mdx b/docs/resources/edges/az-avere-contributor.mdx index 1726f936..e269520d 100644 --- a/docs/resources/edges/az-avere-contributor.mdx +++ b/docs/resources/edges/az-avere-contributor.mdx @@ -1,6 +1,6 @@ --- title: AZAvereContributor -description: Any principal granted the Avere Contributor role, scoped to the affected VM, can reset the built-in administrator password on the VM. +description: "Any principal granted the Avere Contributor role in Azure Resource Manager, scoped to the affected VM, can reset the built-in administrator password on the VM." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-contains.mdx b/docs/resources/edges/az-contains.mdx index cfe9fc30..31252ee9 100644 --- a/docs/resources/edges/az-contains.mdx +++ b/docs/resources/edges/az-contains.mdx @@ -1,6 +1,6 @@ --- title: AZContains -description: "This indicates that the parent object contains the child object, such as a resource group containing a virtual machine, or a tenant “containing” a subscription." +description: "This edge represents containment in the Azure Resource Manager hierarchy, such as a resource group containing a virtual machine or a tenant containing a subscription." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-contributor.mdx b/docs/resources/edges/az-contributor.mdx index f0e18776..6075c0dd 100644 --- a/docs/resources/edges/az-contributor.mdx +++ b/docs/resources/edges/az-contributor.mdx @@ -1,6 +1,6 @@ --- title: AZContributor -description: "The contributor role grants almost all abusable privileges in all circumstances, with some exceptions. Those exceptions are not collected by AzureHound." +description: "An Entra principal has been granted the Azure Resource Manager role called \\\\\\\"Contributor\\\\\\\" over an Azure Resource Manager asset." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-execute-command.mdx b/docs/resources/edges/az-execute-command.mdx index 562460fb..d6181f13 100644 --- a/docs/resources/edges/az-execute-command.mdx +++ b/docs/resources/edges/az-execute-command.mdx @@ -1,6 +1,6 @@ --- title: AZExecuteCommand -description: "Principals with the Intune Administrators role are able to execute arbitrary PowerShell scripts on devices that are joined to the Azure tenant." +description: "Principals with the Intune Administrator role in Microsoft Entra ID can execute arbitrary PowerShell scripts on devices joined to the tenant." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-get-certificates.mdx b/docs/resources/edges/az-get-certificates.mdx index f5af016d..2bd8f401 100644 --- a/docs/resources/edges/az-get-certificates.mdx +++ b/docs/resources/edges/az-get-certificates.mdx @@ -1,6 +1,6 @@ --- title: AZGetCertificates -description: "The ability to read certificates from key vaults." +description: "The ability to read certificates from Azure Key Vault resources in Azure Resource Manager." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-get-keys.mdx b/docs/resources/edges/az-get-keys.mdx index dbf14420..93f53366 100644 --- a/docs/resources/edges/az-get-keys.mdx +++ b/docs/resources/edges/az-get-keys.mdx @@ -1,6 +1,6 @@ --- title: AZGetKeys -description: "The ability to read keys from key vaults." +description: "The ability to read keys from Azure Key Vault resources in Azure Resource Manager." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-get-secrets.mdx b/docs/resources/edges/az-get-secrets.mdx index fc1342e2..baf9e160 100644 --- a/docs/resources/edges/az-get-secrets.mdx +++ b/docs/resources/edges/az-get-secrets.mdx @@ -1,6 +1,6 @@ --- title: AZGetSecrets -description: "The ability to read secrets from key vaults." +description: "The ability to read secrets from Azure Key Vault resources in Azure Resource Manager." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-has-role.mdx b/docs/resources/edges/az-has-role.mdx index f807a213..6cf625a4 100644 --- a/docs/resources/edges/az-has-role.mdx +++ b/docs/resources/edges/az-has-role.mdx @@ -1,6 +1,6 @@ --- title: AZHasRole -description: The principal has an active assignment to the Entra ID role. This includes permanent assignments, and temporary assignments via Privileged Identity Management (PIM). If the principal is assigned eligibility via PIM the principal will also have an [AZRoleEligible](/resources/edges/az-role-eligible) edge to the role. +description: "The principal has an active assignment to the Entra ID role. This includes permanent assignments, and temporary assignments via Privileged Identity Management (PIM). If the principal is assigned eligibility via PIM the principal will also have an [AZRoleEligible](/resources/edges/az-role-eligible) edge to the role." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-key-vault-contributor.mdx b/docs/resources/edges/az-key-vault-contributor.mdx index 0e06c0ee..f66b8743 100644 --- a/docs/resources/edges/az-key-vault-contributor.mdx +++ b/docs/resources/edges/az-key-vault-contributor.mdx @@ -1,6 +1,6 @@ --- title: AZKeyVaultKVContributor -description: "The Key Vault Contributor role grants full control of the target Key Vault. This includes the ability to read all secrets stored on the Key Vault." +description: "The Key Vault Contributor role in Azure Resource Manager grants full control of the target Key Vault. This includes the ability to read all secrets stored on the Key Vault." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-logic-app-contributor.mdx b/docs/resources/edges/az-logic-app-contributor.mdx index c7323225..64696617 100644 --- a/docs/resources/edges/az-logic-app-contributor.mdx +++ b/docs/resources/edges/az-logic-app-contributor.mdx @@ -1,6 +1,6 @@ --- title: AZLogicAppContributor -description: The Logic Contributor role grants full control of the target Logic App. This includes the ability to execute arbitrary commands on the Logic App. +description: "The Logic Contributor role in Azure Resource Manager grants full control of the target Logic App. This includes the ability to execute arbitrary commands on the Logic App." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-managed-identity.mdx b/docs/resources/edges/az-managed-identity.mdx index d0e5ec8a..c939bdcc 100644 --- a/docs/resources/edges/az-managed-identity.mdx +++ b/docs/resources/edges/az-managed-identity.mdx @@ -1,6 +1,6 @@ --- title: AZManagedIdentity -description: "Azure resources like Virtual Machines, Logic Apps, and Automation Accounts can be assigned to either System- or User-Assigned Managed Identities." +description: "Azure Resource Manager resources, such as virtual machines, Logic Apps, and Automation accounts, can be assigned system-assigned or user-assigned managed identities in Microsoft Entra ID." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-member-of.mdx b/docs/resources/edges/az-member-of.mdx index 6558b937..ef15c944 100644 --- a/docs/resources/edges/az-member-of.mdx +++ b/docs/resources/edges/az-member-of.mdx @@ -1,6 +1,6 @@ --- title: AZMemberOf -description: "The given asset is a member of the group." +description: "The given Microsoft Entra ID asset is a member of the group." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-add-member.mdx b/docs/resources/edges/az-mg-add-member.mdx index 3cacc599..0e9a0687 100644 --- a/docs/resources/edges/az-mg-add-member.mdx +++ b/docs/resources/edges/az-mg-add-member.mdx @@ -1,6 +1,6 @@ --- title: AZMGAddMember -description: "This edge is created during post-processing." +description: "This edge is created during post-processing to represent an effective permission in Microsoft Entra ID." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-add-owner.mdx b/docs/resources/edges/az-mg-add-owner.mdx index 88f49598..9ab0e31c 100644 --- a/docs/resources/edges/az-mg-add-owner.mdx +++ b/docs/resources/edges/az-mg-add-owner.mdx @@ -1,6 +1,6 @@ --- title: AZMGAddOwner -description: "This edge is created during post-processing." +description: "This edge is created during post-processing to represent an effective permission in Microsoft Entra ID." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-add-secret.mdx b/docs/resources/edges/az-mg-add-secret.mdx index 39fed961..4adff3f4 100644 --- a/docs/resources/edges/az-mg-add-secret.mdx +++ b/docs/resources/edges/az-mg-add-secret.mdx @@ -1,6 +1,6 @@ --- title: AZMGAddSecret -description: "This edge is created during post-processing." +description: "This edge is created during post-processing to represent an effective permission in Microsoft Entra ID." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-app-role-assignment-readwrite-all.mdx b/docs/resources/edges/az-mg-app-role-assignment-readwrite-all.mdx index ff0fc1b4..24359869 100644 --- a/docs/resources/edges/az-mg-app-role-assignment-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-app-role-assignment-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGAppRoleAssignment_ReadWrite_All -description: "This edge is created when a Service Principal has been granted the AppRoleAssignment.ReadWrite.All edge." +description: "This edge is created when a service principal has been granted the AppRoleAssignment.ReadWrite.All Microsoft Entra ID app role." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-application-readwrite-all.mdx b/docs/resources/edges/az-mg-application-readwrite-all.mdx index 3869b1b8..2c5c9504 100644 --- a/docs/resources/edges/az-mg-application-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-application-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGApplication_ReadWrite_All -description: "This edge is created when a Service Principal has been granted the Application.ReadWrite.All edge." +description: "This edge is created when a service principal has been granted the Application.ReadWrite.All Microsoft Entra ID app role." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-directory-readwrite-all.mdx b/docs/resources/edges/az-mg-directory-readwrite-all.mdx index 0653c542..dbb73670 100644 --- a/docs/resources/edges/az-mg-directory-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-directory-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGDirectory_ReadWrite_All -description: "This edge is created when a Service Principal has been granted the Directory.ReadWrite.All edge." +description: "This edge is created when a service principal has been granted the Directory.ReadWrite.All Microsoft Entra ID app role." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-grant-app-roles.mdx b/docs/resources/edges/az-mg-grant-app-roles.mdx index a60f88ba..63ab6abe 100644 --- a/docs/resources/edges/az-mg-grant-app-roles.mdx +++ b/docs/resources/edges/az-mg-grant-app-roles.mdx @@ -1,6 +1,6 @@ --- title: AZMGGrantAppRoles -description: "This edge is created during post-processing." +description: "This edge is created during post-processing to represent an effective permission in Microsoft Entra ID." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-grant-role.mdx b/docs/resources/edges/az-mg-grant-role.mdx index 685bca40..13780915 100644 --- a/docs/resources/edges/az-mg-grant-role.mdx +++ b/docs/resources/edges/az-mg-grant-role.mdx @@ -1,6 +1,6 @@ --- title: AZMGGrantRole -description: "This edge is created during post-processing." +description: "This edge is created during post-processing to represent an effective permission in Microsoft Entra ID." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-group-member-readwrite-all.mdx b/docs/resources/edges/az-mg-group-member-readwrite-all.mdx index 3554927c..87fbc610 100644 --- a/docs/resources/edges/az-mg-group-member-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-group-member-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGGroupMember_ReadWrite_All -description: "This edge is created when a Service Principal has been granted the GroupMember.ReadWrite.All edge." +description: "This edge is created when a service principal has been granted the GroupMember.ReadWrite.All Microsoft Entra ID app role." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-group-readwrite-all.mdx b/docs/resources/edges/az-mg-group-readwrite-all.mdx index af7d8d2c..90d73d07 100644 --- a/docs/resources/edges/az-mg-group-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-group-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGGroup_ReadWrite_All -description: "This edge is created when a Service Principal has been granted the Group.ReadWrite.All edge." +description: "This edge is created when a service principal has been granted the Group.ReadWrite.All Microsoft Entra ID app role." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-role-management-readwrite-directory.mdx b/docs/resources/edges/az-mg-role-management-readwrite-directory.mdx index 3f783c77..2b500373 100644 --- a/docs/resources/edges/az-mg-role-management-readwrite-directory.mdx +++ b/docs/resources/edges/az-mg-role-management-readwrite-directory.mdx @@ -1,6 +1,6 @@ --- title: AZMGRoleManagement_ReadWrite_Directory -description: "This edge is created when a Service Principal has been granted the RoleManagement.ReadWrite.Directory edge." +description: "This edge is created when a service principal has been granted the RoleManagement.ReadWrite.Directory Microsoft Entra ID app role." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-service-principal-endpoint-readwrite-all.mdx b/docs/resources/edges/az-mg-service-principal-endpoint-readwrite-all.mdx index 4a6eb8fb..0f056680 100644 --- a/docs/resources/edges/az-mg-service-principal-endpoint-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-service-principal-endpoint-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGServicePrincipalEndpoint_ReadWrite_All -description: "This edge is created when a Service Principal has been granted the ServicePrincipalEndpoint.ReadWrite.All edge." +description: "This edge is created when a service principal has been granted the ServicePrincipalEndpoint.ReadWrite.All Microsoft Entra ID app role." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-node-resource-group.mdx b/docs/resources/edges/az-node-resource-group.mdx index c1103208..cbbc51c5 100644 --- a/docs/resources/edges/az-node-resource-group.mdx +++ b/docs/resources/edges/az-node-resource-group.mdx @@ -1,6 +1,6 @@ --- title: AZNodeResourceGroup -description: "This edge is created to link Azure Kubernetes Service Managed Clusters to the Virtual Machine Scale Sets they use to execute commands on." +description: "This Azure Resource Manager edge links Azure Kubernetes Service managed clusters to the virtual machine scale sets they use to execute commands." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-owns.mdx b/docs/resources/edges/az-owns.mdx index 5cecb1ad..da46c3b4 100644 --- a/docs/resources/edges/az-owns.mdx +++ b/docs/resources/edges/az-owns.mdx @@ -1,6 +1,6 @@ --- title: AZOwns -description: An Entra principal has been added as an owner over an Entra asset. +description: "A Microsoft Entra ID principal has been added as an owner over a Microsoft Entra ID asset." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-reset-password.mdx b/docs/resources/edges/az-reset-password.mdx index a638cb09..9df32758 100644 --- a/docs/resources/edges/az-reset-password.mdx +++ b/docs/resources/edges/az-reset-password.mdx @@ -1,6 +1,6 @@ --- title: AZResetPassword -description: "The ability to change another user’s password without knowing their current password." +description: "The ability to change another user’s password in Microsoft Entra ID without knowing their current password." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-role-approver.mdx b/docs/resources/edges/az-role-approver.mdx index 4c93dec5..8021fd65 100644 --- a/docs/resources/edges/az-role-approver.mdx +++ b/docs/resources/edges/az-role-approver.mdx @@ -1,6 +1,6 @@ --- title: AZRoleApprover -description: The principal is designated as an approver in the Privileged Identity Management (PIM) policy for the Entra ID role. PIM policies may require principals with the [AZRoleEligible](/resources/edges/az-role-eligible) edge to get approval from role approvers before activation takes effect. +description: "The principal is designated as an approver in the Privileged Identity Management (PIM) policy for the Entra ID role. PIM policies may require principals with the [AZRoleEligible](/resources/edges/az-role-eligible) edge to get approval from role approvers before activation takes effect." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-role-eligible.mdx b/docs/resources/edges/az-role-eligible.mdx index 7c78b4f0..78264e9a 100644 --- a/docs/resources/edges/az-role-eligible.mdx +++ b/docs/resources/edges/az-role-eligible.mdx @@ -1,6 +1,6 @@ --- title: AZRoleEligible -description: The principal is eligible for assignment to the Entra ID role via Privileged Identity Management (PIM). When the role is active the principal will also have an [AZHasRole](/resources/edges/az-has-role) edge to the role. +description: "The principal is eligible for assignment to the Entra ID role via Privileged Identity Management (PIM). When the role is active the principal will also have an [AZHasRole](/resources/edges/az-has-role) edge to the role." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-runs-as.mdx b/docs/resources/edges/az-runs-as.mdx index 62f0e9b0..0a7b2a58 100644 --- a/docs/resources/edges/az-runs-as.mdx +++ b/docs/resources/edges/az-runs-as.mdx @@ -1,6 +1,6 @@ --- title: AZRunsAs -description: "The Azure App runs as the Service Principal when it needs to authenticate to the tenant." +description: "The application registration in Microsoft Entra ID runs as the service principal when it needs to authenticate to the tenant." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-scoped-to.mdx b/docs/resources/edges/az-scoped-to.mdx index 70b718e7..e06aa47f 100644 --- a/docs/resources/edges/az-scoped-to.mdx +++ b/docs/resources/edges/az-scoped-to.mdx @@ -1,6 +1,6 @@ --- title: AZScopedTo -description: "Is used to distinguish whether an EntraID (AzureAD) admin role such as Application Administrator or Cloud Application Administrator is scoped to the tenant or to a particular app registration or service principal." +description: "Distinguishes whether a Microsoft Entra ID admin role, such as Application Administrator or Cloud Application Administrator, is scoped to the tenant or to a particular application registration or service principal." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-user-access-administrator.mdx b/docs/resources/edges/az-user-access-administrator.mdx index ba41be1c..17ca1dfd 100644 --- a/docs/resources/edges/az-user-access-administrator.mdx +++ b/docs/resources/edges/az-user-access-administrator.mdx @@ -1,6 +1,6 @@ --- title: AZUserAccessAdministrator -description: "The User Access Admin role can edit roles against many other objects." +description: "An Entra principal has been granted the Azure Resource Manager role called \\\"User Access Administrator\\\" over an Azure Resource Manager asset." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-vm-admin-login.mdx b/docs/resources/edges/az-vm-admin-login.mdx index 981f85e4..612019d9 100644 --- a/docs/resources/edges/az-vm-admin-login.mdx +++ b/docs/resources/edges/az-vm-admin-login.mdx @@ -1,6 +1,6 @@ --- title: AZVMAdminLogin -description: "When a virtual machine is configured to allow logon with Azure credentials, the VM automatically has certain principals added to its local administrators group, including any principal granted the Virtual Machine Administrator Login (or “VMAL”) admin role." +description: "When an Azure Resource Manager virtual machine is configured to allow sign-in with Microsoft Entra ID credentials, principals granted the Virtual Machine Administrator Login role are added to its local Administrators group." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-vm-contributor.mdx b/docs/resources/edges/az-vm-contributor.mdx index 659d087c..2d02f3be 100644 --- a/docs/resources/edges/az-vm-contributor.mdx +++ b/docs/resources/edges/az-vm-contributor.mdx @@ -1,6 +1,6 @@ --- title: AZVMContributor -description: "The Virtual Machine contributor role grants almost all abusable privileges against Virtual Machines." +description: "The Virtual Machine Contributor role in Azure Resource Manager grants almost all abusable privileges against virtual machines." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-website-contributor.mdx b/docs/resources/edges/az-website-contributor.mdx index 25657361..94e7b060 100644 --- a/docs/resources/edges/az-website-contributor.mdx +++ b/docs/resources/edges/az-website-contributor.mdx @@ -1,6 +1,6 @@ --- title: AZWebsiteContributor -description: "The Website Contributor role grants full control of the target Function App or Web App. Full control of either of those types of resources allows for arbitrary command execution against the target resoruce." +description: "The Website Contributor role in Azure Resource Manager grants full control of the target Function App or Web App. Full control of either resource allows arbitrary command execution against the target resource." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/nodes/az-app.mdx b/docs/resources/nodes/az-app.mdx index b163632e..ea5ca5ca 100644 --- a/docs/resources/nodes/az-app.mdx +++ b/docs/resources/nodes/az-app.mdx @@ -1,5 +1,6 @@ --- title: AZApp +description: "The AZApp node represents an application registration in Microsoft Entra ID." icon: '/images/nodes/azure/az-app.svg' --- diff --git a/docs/resources/nodes/az-automation-account.mdx b/docs/resources/nodes/az-automation-account.mdx index a40c513a..703fa521 100644 --- a/docs/resources/nodes/az-automation-account.mdx +++ b/docs/resources/nodes/az-automation-account.mdx @@ -1,5 +1,6 @@ --- title: AZAutomationAccount +description: "The AZAutomationAccount node represents an Azure Automation account in Azure Resource Manager." icon: '/images/nodes/azure/az-automation-account.svg' --- diff --git a/docs/resources/nodes/az-base.mdx b/docs/resources/nodes/az-base.mdx index a4c73be7..47301c73 100644 --- a/docs/resources/nodes/az-base.mdx +++ b/docs/resources/nodes/az-base.mdx @@ -1,5 +1,6 @@ --- title: AZBase +description: "The AZBase node represents an unknown Microsoft Entra ID or Azure Resource Manager object." icon: '/images/nodes/azure/az-base.svg' --- diff --git a/docs/resources/nodes/az-container-registry.mdx b/docs/resources/nodes/az-container-registry.mdx index 6d8f1c3e..171f1122 100644 --- a/docs/resources/nodes/az-container-registry.mdx +++ b/docs/resources/nodes/az-container-registry.mdx @@ -1,5 +1,6 @@ --- title: AZContainerRegistry +description: "The AZContainerRegistry node represents an Azure Container Registry in Azure Resource Manager." icon: '/images/nodes/azure/az-container-registry.svg' --- diff --git a/docs/resources/nodes/az-device.mdx b/docs/resources/nodes/az-device.mdx index 7089b912..49456bb2 100644 --- a/docs/resources/nodes/az-device.mdx +++ b/docs/resources/nodes/az-device.mdx @@ -1,5 +1,6 @@ --- title: AZDevice +description: "The AZDevice node represents a device identity in Microsoft Entra ID." icon: '/images/nodes/azure/az-device.svg' --- diff --git a/docs/resources/nodes/az-federated-identity-credential.mdx b/docs/resources/nodes/az-federated-identity-credential.mdx index 0aa05f6f..cee0b900 100644 --- a/docs/resources/nodes/az-federated-identity-credential.mdx +++ b/docs/resources/nodes/az-federated-identity-credential.mdx @@ -1,6 +1,6 @@ --- title: AZFederatedIdentityCredential -description: The AZFederatedIdentityCredential node represents a Federated Identity Credential (FIC) configured on an Azure App Registration, which allows an external identity provider to authenticate as the application without a password or certificate. +description: "The AZFederatedIdentityCredential node represents a Federated Identity Credential configured on an application registration in Microsoft Entra ID." icon: '/images/nodes/azure/az-federated-identity-credential.svg' --- diff --git a/docs/resources/nodes/az-function-app.mdx b/docs/resources/nodes/az-function-app.mdx index cdbc8cb1..f865cada 100644 --- a/docs/resources/nodes/az-function-app.mdx +++ b/docs/resources/nodes/az-function-app.mdx @@ -1,5 +1,6 @@ --- title: AZFunctionApp +description: "The AZFunctionApp node represents an Azure Function App in Azure Resource Manager." icon: '/images/nodes/azure/az-function-app.svg' --- diff --git a/docs/resources/nodes/az-group.mdx b/docs/resources/nodes/az-group.mdx index 9e2feab5..0eb60de8 100644 --- a/docs/resources/nodes/az-group.mdx +++ b/docs/resources/nodes/az-group.mdx @@ -1,5 +1,6 @@ --- title: AZGroup +description: "The AZGroup node represents a group in Microsoft Entra ID." icon: '/images/nodes/azure/az-group.svg' --- diff --git a/docs/resources/nodes/az-key-vault.mdx b/docs/resources/nodes/az-key-vault.mdx index 305f7172..2098bb55 100644 --- a/docs/resources/nodes/az-key-vault.mdx +++ b/docs/resources/nodes/az-key-vault.mdx @@ -1,5 +1,6 @@ --- title: AZKeyVault +description: "The AZKeyVault node represents an Azure Key Vault in Azure Resource Manager." icon: '/images/nodes/azure/az-key-vault.svg' --- diff --git a/docs/resources/nodes/az-logic-app.mdx b/docs/resources/nodes/az-logic-app.mdx index c5ae8f42..611c62db 100644 --- a/docs/resources/nodes/az-logic-app.mdx +++ b/docs/resources/nodes/az-logic-app.mdx @@ -1,5 +1,6 @@ --- title: AZLogicApp +description: "The AZLogicApp node represents an Azure Logic App in Azure Resource Manager." icon: '/images/nodes/azure/az-logic-app.svg' --- diff --git a/docs/resources/nodes/az-managed-cluster.mdx b/docs/resources/nodes/az-managed-cluster.mdx index f4736f11..cedcf701 100644 --- a/docs/resources/nodes/az-managed-cluster.mdx +++ b/docs/resources/nodes/az-managed-cluster.mdx @@ -1,5 +1,6 @@ --- title: AZManagedCluster +description: "The AZManagedCluster node represents an Azure Kubernetes Service managed cluster in Azure Resource Manager." icon: '/images/nodes/azure/az-managed-cluster.svg' --- diff --git a/docs/resources/nodes/az-management-group.mdx b/docs/resources/nodes/az-management-group.mdx index de291b7c..036e51b8 100644 --- a/docs/resources/nodes/az-management-group.mdx +++ b/docs/resources/nodes/az-management-group.mdx @@ -1,5 +1,6 @@ --- title: AZManagementGroup +description: "The AZManagementGroup node represents an Azure management group in Azure Resource Manager." icon: '/images/nodes/azure/az-management-group.svg' --- diff --git a/docs/resources/nodes/az-resource-group.mdx b/docs/resources/nodes/az-resource-group.mdx index 12078ee6..a9a1eb30 100644 --- a/docs/resources/nodes/az-resource-group.mdx +++ b/docs/resources/nodes/az-resource-group.mdx @@ -1,5 +1,6 @@ --- title: AZResourceGroup +description: "The AZResourceGroup node represents an Azure resource group in Azure Resource Manager." icon: '/images/nodes/azure/az-resource-group.svg' --- diff --git a/docs/resources/nodes/az-role.mdx b/docs/resources/nodes/az-role.mdx index 4ed81c7b..4e7d0d15 100644 --- a/docs/resources/nodes/az-role.mdx +++ b/docs/resources/nodes/az-role.mdx @@ -1,5 +1,6 @@ --- title: AZRole +description: "The AZRole node represents a directory role in Microsoft Entra ID." icon: '/images/nodes/azure/az-role.svg' --- diff --git a/docs/resources/nodes/az-service-principal.mdx b/docs/resources/nodes/az-service-principal.mdx index 5a6fcea4..e6749fac 100644 --- a/docs/resources/nodes/az-service-principal.mdx +++ b/docs/resources/nodes/az-service-principal.mdx @@ -1,5 +1,6 @@ --- title: AZServicePrincipal +description: "The AZServicePrincipal node represents a service principal in Microsoft Entra ID." icon: '/images/nodes/azure/az-service-principal.svg' --- diff --git a/docs/resources/nodes/az-subscription.mdx b/docs/resources/nodes/az-subscription.mdx index d72f25ac..1c5996d6 100644 --- a/docs/resources/nodes/az-subscription.mdx +++ b/docs/resources/nodes/az-subscription.mdx @@ -1,5 +1,6 @@ --- title: AZSubscription +description: "The AZSubscription node represents an Azure subscription in Azure Resource Manager." icon: '/images/nodes/azure/az-subscription.svg' --- diff --git a/docs/resources/nodes/az-tenant.mdx b/docs/resources/nodes/az-tenant.mdx index 34433445..863c5898 100644 --- a/docs/resources/nodes/az-tenant.mdx +++ b/docs/resources/nodes/az-tenant.mdx @@ -1,5 +1,6 @@ --- title: AZTenant +description: "The AZTenant node represents a tenant in Microsoft Entra ID." icon: '/images/nodes/azure/az-tenant.svg' --- diff --git a/docs/resources/nodes/az-user.mdx b/docs/resources/nodes/az-user.mdx index ede8a45e..3e497b8d 100644 --- a/docs/resources/nodes/az-user.mdx +++ b/docs/resources/nodes/az-user.mdx @@ -1,5 +1,6 @@ --- title: AZUser +description: "The AZUser node represents a user account in Microsoft Entra ID." icon: '/images/nodes/azure/az-user.svg' --- diff --git a/docs/resources/nodes/az-vm-scale-set.mdx b/docs/resources/nodes/az-vm-scale-set.mdx index 8ffe38a6..442ccd42 100644 --- a/docs/resources/nodes/az-vm-scale-set.mdx +++ b/docs/resources/nodes/az-vm-scale-set.mdx @@ -1,5 +1,6 @@ --- title: AZVMScaleSet +description: "The AZVMScaleSet node represents an Azure Virtual Machine Scale Set in Azure Resource Manager." icon: '/images/nodes/azure/az-vm-scale-set.svg' --- diff --git a/docs/resources/nodes/az-vm.mdx b/docs/resources/nodes/az-vm.mdx index b966db2d..aa94ba88 100644 --- a/docs/resources/nodes/az-vm.mdx +++ b/docs/resources/nodes/az-vm.mdx @@ -1,5 +1,6 @@ --- title: AZVM +description: "The AZVM node represents an Azure virtual machine in Azure Resource Manager." icon: '/images/nodes/azure/az-vm.svg' --- diff --git a/docs/resources/nodes/az-web-app.mdx b/docs/resources/nodes/az-web-app.mdx index 9dfb4b4e..42bd9038 100644 --- a/docs/resources/nodes/az-web-app.mdx +++ b/docs/resources/nodes/az-web-app.mdx @@ -1,5 +1,6 @@ --- title: AZWebApp +description: "The AZWebApp node represents an Azure Web App in Azure Resource Manager." icon: '/images/nodes/azure/az-web-app.svg' --- From 987a065a3e0f5dac59c6e00e10a5a129f09954a9 Mon Sep 17 00:00:00 2001 From: Martin Sohn Christensen Date: Wed, 26 Aug 2026 23:57:12 +0200 Subject: [PATCH 03/11] Add Microsoft API references to AZ role edges. --- docs/resources/edges/az-aks-contributor.mdx | 1 + docs/resources/edges/az-automation-contributor.mdx | 5 +++-- docs/resources/edges/az-avere-contributor.mdx | 2 +- docs/resources/edges/az-contributor.mdx | 7 ++++--- docs/resources/edges/az-key-vault-contributor.mdx | 1 + docs/resources/edges/az-logic-app-contributor.mdx | 7 ++++--- docs/resources/edges/az-owner.mdx | 7 ++++--- docs/resources/edges/az-user-access-administrator.mdx | 5 +++-- docs/resources/edges/az-vm-admin-login.mdx | 7 ++++--- docs/resources/edges/az-vm-contributor.mdx | 7 ++++--- docs/resources/edges/az-website-contributor.mdx | 7 ++++--- 11 files changed, 33 insertions(+), 23 deletions(-) diff --git a/docs/resources/edges/az-aks-contributor.mdx b/docs/resources/edges/az-aks-contributor.mdx index 949cae4b..d229fc64 100644 --- a/docs/resources/edges/az-aks-contributor.mdx +++ b/docs/resources/edges/az-aks-contributor.mdx @@ -47,6 +47,7 @@ If successful, the output will include a JWT for the managed identity service pr ## References +* [Azure Kubernetes Service Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/containers#azure-kubernetes-service-contributor-role) * [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK) * [https://www.netspi.com/blog/technical/cloud-penetration-testing/extract-credentials-from-azure-kubernetes-service/](https://www.netspi.com/blog/technical/cloud-penetration-testing/extract-credentials-from-azure-kubernetes-service/) * [https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/](https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/) diff --git a/docs/resources/edges/az-automation-contributor.mdx b/docs/resources/edges/az-automation-contributor.mdx index eb3a8a46..c1de67d0 100644 --- a/docs/resources/edges/az-automation-contributor.mdx +++ b/docs/resources/edges/az-automation-contributor.mdx @@ -50,7 +50,8 @@ If successful, the output will include a JWT for the managed identity service pr -## References -* [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK) +## References +* [Automation Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/management-and-governance#automation-contributor) +* [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK) * [https://specterops.io/blog/2022/06/06/managed-identity-attack-paths-part-1-automation-accounts/](https://specterops.io/blog/2022/06/06/managed-identity-attack-paths-part-1-automation-accounts/) * [https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/](https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/) diff --git a/docs/resources/edges/az-avere-contributor.mdx b/docs/resources/edges/az-avere-contributor.mdx index e269520d..5e82dd7c 100644 --- a/docs/resources/edges/az-avere-contributor.mdx +++ b/docs/resources/edges/az-avere-contributor.mdx @@ -26,4 +26,4 @@ Because you’ll be running a command as the SYSTEM user on the Virtual Machine, * [https://attack.mitre.org/tactics/TA0008/](https://attack.mitre.org/tactics/TA0008/) * [https://attack.mitre.org/techniques/T1021/](https://attack.mitre.org/techniques/T1021/) -* [https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#avere-contributor](https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#avere-contributor) +* [Avere Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage#avere-contributor) diff --git a/docs/resources/edges/az-contributor.mdx b/docs/resources/edges/az-contributor.mdx index 6075c0dd..28e40f03 100644 --- a/docs/resources/edges/az-contributor.mdx +++ b/docs/resources/edges/az-contributor.mdx @@ -25,9 +25,10 @@ This depends on what the target object is: -## References - -* [https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/](https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/) +## References + +* [Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/privileged#contributor) +* [https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/](https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/) * [https://blog.netspi.com/azure-automation-accounts-key-stores/](https://blog.netspi.com/azure-automation-accounts-key-stores/) * [https://blog.netspi.com/get-azurepasswords/](https://blog.netspi.com/get-azurepasswords/) * [https://blog.netspi.com/attacking-azure-cloud-shell/](https://blog.netspi.com/attacking-azure-cloud-shell/) diff --git a/docs/resources/edges/az-key-vault-contributor.mdx b/docs/resources/edges/az-key-vault-contributor.mdx index f66b8743..681f27cb 100644 --- a/docs/resources/edges/az-key-vault-contributor.mdx +++ b/docs/resources/edges/az-key-vault-contributor.mdx @@ -24,6 +24,7 @@ Via PowerZure: ## References +* [Key Vault Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/security#key-vault-contributor) * [https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/](https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/) * [https://blog.netspi.com/azure-automation-accounts-key-stores/](https://blog.netspi.com/azure-automation-accounts-key-stores/) * [https://blog.netspi.com/get-azurepasswords/](https://blog.netspi.com/get-azurepasswords/) diff --git a/docs/resources/edges/az-logic-app-contributor.mdx b/docs/resources/edges/az-logic-app-contributor.mdx index 64696617..d04e4826 100644 --- a/docs/resources/edges/az-logic-app-contributor.mdx +++ b/docs/resources/edges/az-logic-app-contributor.mdx @@ -18,8 +18,9 @@ You can see a full walkthrough for executing that abuse in this blog post: [And -## References - -* [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK) +## References + +* [Logic App Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/integration#logic-app-contributor) +* [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK) * [https://medium.com/p/52b29354fc54](https://medium.com/p/52b29354fc54) * [https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/](https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/) diff --git a/docs/resources/edges/az-owner.mdx b/docs/resources/edges/az-owner.mdx index 90c9d56b..776e5f80 100644 --- a/docs/resources/edges/az-owner.mdx +++ b/docs/resources/edges/az-owner.mdx @@ -19,7 +19,8 @@ Everything a Contributor can do, with the addition of assigning rights to resour This depends on which abuse you perform, but in general Azure will create a log for each abuse action. -## References - -* [https://blog.netspi.com/attacking-azure-with-custom-script-extensions/](https://blog.netspi.com/attacking-azure-with-custom-script-extensions/) +## References + +* [Owner](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/privileged#owner) +* [https://blog.netspi.com/attacking-azure-with-custom-script-extensions/](https://blog.netspi.com/attacking-azure-with-custom-script-extensions/) * [https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#owner](https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#owner) diff --git a/docs/resources/edges/az-user-access-administrator.mdx b/docs/resources/edges/az-user-access-administrator.mdx index 17ca1dfd..46012f2f 100644 --- a/docs/resources/edges/az-user-access-administrator.mdx +++ b/docs/resources/edges/az-user-access-administrator.mdx @@ -25,5 +25,6 @@ Using that token, you can make a call to the AzureRM API to create a new role as Azure will log any role activation event for any object type. -## References -* [https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/](https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/) +## References +* [User Access Administrator](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/privileged#user-access-administrator) +* [https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/](https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/) diff --git a/docs/resources/edges/az-vm-admin-login.mdx b/docs/resources/edges/az-vm-admin-login.mdx index 612019d9..982fe150 100644 --- a/docs/resources/edges/az-vm-admin-login.mdx +++ b/docs/resources/edges/az-vm-admin-login.mdx @@ -20,9 +20,10 @@ If the target computer is a workstation and a user is currently logged on, one o Remote desktop will create Logon and Logoff events with the access type RemoteInteractive. -## References - -* [https://attack.mitre.org/tactics/TA0008/](https://attack.mitre.org/tactics/TA0008/) +## References + +* [Virtual Machine Administrator Login](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/compute#virtual-machine-administrator-login) +* [https://attack.mitre.org/tactics/TA0008/](https://attack.mitre.org/tactics/TA0008/) * [https://attack.mitre.org/techniques/T1021/](https://attack.mitre.org/techniques/T1021/) * [https://learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-windows](https://learn.microsoft.com/en-us/entra/identity/devices/howto-vm-sign-in-azure-ad-windows) * [https://specterops.io/blog/2022/08/03/introducing-bloodhound-4-2-the-azure-refactor/](https://specterops.io/blog/2022/08/03/introducing-bloodhound-4-2-the-azure-refactor/) diff --git a/docs/resources/edges/az-vm-contributor.mdx b/docs/resources/edges/az-vm-contributor.mdx index 2d02f3be..f250b532 100644 --- a/docs/resources/edges/az-vm-contributor.mdx +++ b/docs/resources/edges/az-vm-contributor.mdx @@ -21,6 +21,7 @@ Via PowerZure: Because you’ll be running a command as the SYSTEM user on the Virtual Machine, the same opsec considerations for running malicious commands on any system should be taken into account: command line logging, PowerShell script block logging, EDR, etc. -## References - -* [https://blog.netspi.com/running-powershell-scripts-on-azure-vms/](https://blog.netspi.com/running-powershell-scripts-on-azure-vms/) +## References + +* [Virtual Machine Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/compute#virtual-machine-contributor) +* [https://blog.netspi.com/running-powershell-scripts-on-azure-vms/](https://blog.netspi.com/running-powershell-scripts-on-azure-vms/) diff --git a/docs/resources/edges/az-website-contributor.mdx b/docs/resources/edges/az-website-contributor.mdx index 94e7b060..52d869cf 100644 --- a/docs/resources/edges/az-website-contributor.mdx +++ b/docs/resources/edges/az-website-contributor.mdx @@ -53,9 +53,10 @@ If successful, the output will include a JWT for the managed identity service pr -## References - -* [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK) +## References + +* [Website Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/web-and-mobile#website-contributor) +* [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK) * [https://www.netspi.com/blog/technical/cloud-penetration-testing/lateral-movement-azure-app-services/](https://www.netspi.com/blog/technical/cloud-penetration-testing/lateral-movement-azure-app-services/) * [https://specterops.io/blog/2023/02/15/abusing-azure-app-service-managed-identity-assignments/](https://specterops.io/blog/2023/02/15/abusing-azure-app-service-managed-identity-assignments/) * [https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/](https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/) From 4bf9c7888c5bbaf5e173b8f64cadeec67a5c604f Mon Sep 17 00:00:00 2001 From: Martin Sohn Christensen Date: Wed, 26 Aug 2026 23:57:47 +0200 Subject: [PATCH 04/11] Standardize Entra ID and Azure RM documentation `descriptions` fields Ensure all AZ edge and node `description` fields are concise and platform-aware (if it applies to Microsoft Entra ID, Azure Resource Manager, or both) --- docs/resources/edges/az-owner.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/resources/edges/az-owner.mdx b/docs/resources/edges/az-owner.mdx index 776e5f80..58e56bdc 100644 --- a/docs/resources/edges/az-owner.mdx +++ b/docs/resources/edges/az-owner.mdx @@ -1,6 +1,6 @@ --- title: AZOwner -description: An Entra principal has been granted the Azure Resource Manager role called "Owner" over an Azure Resource Manager asset. +description: "An Entra principal has been granted the Azure Resource Manager role called \\\"Owner\\\" over an Azure Resource Manager asset." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; From 5e696616805b315b02fda8d9407c73a0b934589e Mon Sep 17 00:00:00 2001 From: Martin Sohn Christensen Date: Wed, 26 Aug 2026 23:59:08 +0200 Subject: [PATCH 05/11] Clarify graph model design for AZ RM roles --- docs/resources/edges/az-contributor.mdx | 20 ++++++++++++------- docs/resources/edges/az-owner.mdx | 4 +++- .../edges/az-user-access-administrator.mdx | 20 ++++++++++++------- 3 files changed, 29 insertions(+), 15 deletions(-) diff --git a/docs/resources/edges/az-contributor.mdx b/docs/resources/edges/az-contributor.mdx index 28e40f03..0e4198e8 100644 --- a/docs/resources/edges/az-contributor.mdx +++ b/docs/resources/edges/az-contributor.mdx @@ -6,13 +6,19 @@ description: "An Entra principal has been granted the Azure Resource Manager rol import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; import AzureGenericAbuseLogOpsec from '/snippets/edges/azure-generic-abuse-log-opsec.mdx'; - - - - -## Abuse Info - -This depends on what the target object is: + + +AZContributor targets resources in Azure Resource Manager (for example [AZResourceGroup](/resources/nodes/az-resource-group), [AZSubscription](/resources/nodes/az-subscription), and [AZVM](/resources/nodes/az-vm)) through a role assignment called "Contributor". + +The edge terminates at the role assignment's scope. A role assignment scoped to an [AZManagementGroup](/resources/nodes/az-management-group), [AZSubscription](/resources/nodes/az-subscription), or [AZResourceGroup](/resources/nodes/az-resource-group) is inherited by all child resources. In BloodHound, that inheritance is traversable through the Azure Resource Manager hierarchy via [AZContains](/resources/edges/az-contains) edges. One scoped to a specific resource applies only to that resource. + + + +## Abuse Info + +The Contributor role grants broad management access to Azure Resource Manager resources, but it cannot assign Azure RBAC roles or perform the operations excluded by its `NotActions` list. + +Abuse depends on the target object: * **Key Vault:** You can read secrets and alter access policies (grant yourself access to read secrets) diff --git a/docs/resources/edges/az-owner.mdx b/docs/resources/edges/az-owner.mdx index 58e56bdc..4147e5fc 100644 --- a/docs/resources/edges/az-owner.mdx +++ b/docs/resources/edges/az-owner.mdx @@ -7,7 +7,9 @@ import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; -AZOwner targets resources in Azure Resource Manager (for example [AZResourceGroup](/resources/nodes/az-resource-group), [AZSubscription](/resources/nodes/az-subscription), and [AZVM](/resources/nodes/az-vm)) through role assignment called "Owner". +AZOwner targets resources in Azure Resource Manager (for example [AZResourceGroup](/resources/nodes/az-resource-group), [AZSubscription](/resources/nodes/az-subscription), and [AZVM](/resources/nodes/az-vm)) through a role assignment called "Owner". + +The edge terminates at the role assignment's scope. A role assignment scoped to an [AZManagementGroup](/resources/nodes/az-management-group), [AZSubscription](/resources/nodes/az-subscription), or [AZResourceGroup](/resources/nodes/az-resource-group) is inherited by all child resources. In BloodHound, that inheritance is traversable through the Azure Resource Manager hierarchy via [AZContains](/resources/edges/az-contains) edges. One scoped to a specific resource applies only to that resource. The edges [AZOwner](/resources/edges/az-owner) and [AZOwns](/resources/edges/az-owns) are distinct as they each apply their own distinct identity and access management platform (AzureRM and Entra ID respectively) with distinct mechanics, abuse primitives, and remediation steps. diff --git a/docs/resources/edges/az-user-access-administrator.mdx b/docs/resources/edges/az-user-access-administrator.mdx index 46012f2f..97e97e62 100644 --- a/docs/resources/edges/az-user-access-administrator.mdx +++ b/docs/resources/edges/az-user-access-administrator.mdx @@ -5,13 +5,19 @@ description: "An Entra principal has been granted the Azure Resource Manager rol import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; - - - - -## Abuse Info - -This role can be used to grant yourself or another principal any privilege you want against Automation Accounts, VMs, Key Vaults, and Resource Groups. For example, you can make yourself an administrator of an Azure Subscription by assigning the Owner role at the Subscription scope. + + +AZUserAccessAdministrator targets resources in Azure Resource Manager (for example [AZResourceGroup](/resources/nodes/az-resource-group), [AZSubscription](/resources/nodes/az-subscription), and [AZVM](/resources/nodes/az-vm)) through a role assignment called "User Access Administrator". + +The edge terminates at the role assignment's scope. A role assignment scoped to an [AZManagementGroup](/resources/nodes/az-management-group), [AZSubscription](/resources/nodes/az-subscription), or [AZResourceGroup](/resources/nodes/az-resource-group) is inherited by all child resources. In BloodHound, that inheritance is traversable through the Azure Resource Manager hierarchy via [AZContains](/resources/edges/az-contains) edges. One scoped to a specific resource applies only to that resource. + + + +## Abuse Info + +The User Access Administrator role can manage access by assigning roles to principals within its scope. + +This role can be used to grant yourself or another principal any privilege you want against Automation Accounts, VMs, Key Vaults, and Resource Groups. For example, you can make yourself an administrator of an Azure Subscription by assigning the Owner role at the Subscription scope. The simplest way to execute this attack is to use the Azure portal to add a new, abusable role assignment against the target object for yourself. From 28356793c9a6bac54e62464bd7776a41f641f179 Mon Sep 17 00:00:00 2001 From: Martin Sohn Christensen Date: Thu, 27 Aug 2026 00:13:45 +0200 Subject: [PATCH 06/11] Remove double-double quotes of az-contributor.mdx --- docs/resources/edges/az-contributor.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/resources/edges/az-contributor.mdx b/docs/resources/edges/az-contributor.mdx index 0e4198e8..26769066 100644 --- a/docs/resources/edges/az-contributor.mdx +++ b/docs/resources/edges/az-contributor.mdx @@ -1,6 +1,6 @@ --- title: AZContributor -description: "An Entra principal has been granted the Azure Resource Manager role called \\\\\\\"Contributor\\\\\\\" over an Azure Resource Manager asset." +description: "An Entra principal has been granted the Azure Resource Manager 'Contributor' role over an Azure Resource Manager asset." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; From 94500ad5245cd2a9e47df7e903c1f471bd695568 Mon Sep 17 00:00:00 2001 From: Martin Sohn Christensen Date: Thu, 27 Aug 2026 07:19:31 +0200 Subject: [PATCH 07/11] CR suggestions --- docs/resources/edges/az-automation-contributor.mdx | 2 +- docs/resources/edges/az-contains.mdx | 2 +- docs/resources/edges/az-contributor.mdx | 2 +- docs/resources/edges/az-execute-command.mdx | 2 +- docs/resources/edges/az-owner.mdx | 2 +- docs/resources/edges/az-user-access-administrator.mdx | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/resources/edges/az-automation-contributor.mdx b/docs/resources/edges/az-automation-contributor.mdx index c1de67d0..e6ed2e5e 100644 --- a/docs/resources/edges/az-automation-contributor.mdx +++ b/docs/resources/edges/az-automation-contributor.mdx @@ -1,6 +1,6 @@ --- title: AZAutomationContributor -description: "The Azure Automation Contributor role in Azure Resource Manager grants full control of the target Azure Automation account. This includes the ability to execute arbitrary commands on the Automation account." +description: "The Azure Automation Contributor role in Azure Resource Manager grants full control of the target Azure Automation account. This includes the ability to create and run a runbook that executes arbitrary commands in an Azure sandbox or on a configured Hybrid Runbook Worker." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-contains.mdx b/docs/resources/edges/az-contains.mdx index 31252ee9..888d2480 100644 --- a/docs/resources/edges/az-contains.mdx +++ b/docs/resources/edges/az-contains.mdx @@ -1,6 +1,6 @@ --- title: AZContains -description: "This edge represents containment in the Azure Resource Manager hierarchy, such as a resource group containing a virtual machine or a tenant containing a subscription." +description: "This edge represents containment in Entra ID, or Azure Resource Manager hierarchy." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-contributor.mdx b/docs/resources/edges/az-contributor.mdx index 26769066..a8d79060 100644 --- a/docs/resources/edges/az-contributor.mdx +++ b/docs/resources/edges/az-contributor.mdx @@ -10,7 +10,6 @@ import AzureGenericAbuseLogOpsec from '/snippets/edges/azure-generic-abuse-log-o AZContributor targets resources in Azure Resource Manager (for example [AZResourceGroup](/resources/nodes/az-resource-group), [AZSubscription](/resources/nodes/az-subscription), and [AZVM](/resources/nodes/az-vm)) through a role assignment called "Contributor". -The edge terminates at the role assignment's scope. A role assignment scoped to an [AZManagementGroup](/resources/nodes/az-management-group), [AZSubscription](/resources/nodes/az-subscription), or [AZResourceGroup](/resources/nodes/az-resource-group) is inherited by all child resources. In BloodHound, that inheritance is traversable through the Azure Resource Manager hierarchy via [AZContains](/resources/edges/az-contains) edges. One scoped to a specific resource applies only to that resource. @@ -19,6 +18,7 @@ The edge terminates at the role assignment's scope. A role assignment scoped to The Contributor role grants broad management access to Azure Resource Manager resources, but it cannot assign Azure RBAC roles or perform the operations excluded by its `NotActions` list. Abuse depends on the target object: +The edge terminates at the role assignment's scope. A role assignment scoped to an [AZManagementGroup](/resources/nodes/az-management-group), [AZSubscription](/resources/nodes/az-subscription), or [AZResourceGroup](/resources/nodes/az-resource-group) is inherited by all child resources. In BloodHound, that inheritance is traversable through the Azure Resource Manager hierarchy via [AZContains](/resources/edges/az-contains) edges. One scoped to a specific resource applies to that resource and, where applicable, its nested child resources. * **Key Vault:** You can read secrets and alter access policies (grant yourself access to read secrets) diff --git a/docs/resources/edges/az-execute-command.mdx b/docs/resources/edges/az-execute-command.mdx index d6181f13..f12920e4 100644 --- a/docs/resources/edges/az-execute-command.mdx +++ b/docs/resources/edges/az-execute-command.mdx @@ -1,6 +1,6 @@ --- title: AZExecuteCommand -description: "Principals with the Intune Administrator role in Microsoft Entra ID can execute arbitrary PowerShell scripts on devices joined to the tenant." +description: "Principals with the Intune Administrator role in Microsoft Entra ID can execute arbitrary PowerShell scripts on Windows devices enrolled in and managed through Intune." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-owner.mdx b/docs/resources/edges/az-owner.mdx index 4147e5fc..628b17dd 100644 --- a/docs/resources/edges/az-owner.mdx +++ b/docs/resources/edges/az-owner.mdx @@ -9,7 +9,7 @@ import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; AZOwner targets resources in Azure Resource Manager (for example [AZResourceGroup](/resources/nodes/az-resource-group), [AZSubscription](/resources/nodes/az-subscription), and [AZVM](/resources/nodes/az-vm)) through a role assignment called "Owner". -The edge terminates at the role assignment's scope. A role assignment scoped to an [AZManagementGroup](/resources/nodes/az-management-group), [AZSubscription](/resources/nodes/az-subscription), or [AZResourceGroup](/resources/nodes/az-resource-group) is inherited by all child resources. In BloodHound, that inheritance is traversable through the Azure Resource Manager hierarchy via [AZContains](/resources/edges/az-contains) edges. One scoped to a specific resource applies only to that resource. +The edge terminates at the role assignment's scope. A role assignment scoped to an [AZManagementGroup](/resources/nodes/az-management-group), [AZSubscription](/resources/nodes/az-subscription), or [AZResourceGroup](/resources/nodes/az-resource-group) is inherited by all child resources. In BloodHound, that inheritance is traversable through the Azure Resource Manager hierarchy via [AZContains](/resources/edges/az-contains) edges. One scoped to a specific resource applies to that resource and, where applicable, its nested child resources. The edges [AZOwner](/resources/edges/az-owner) and [AZOwns](/resources/edges/az-owns) are distinct as they each apply their own distinct identity and access management platform (AzureRM and Entra ID respectively) with distinct mechanics, abuse primitives, and remediation steps. diff --git a/docs/resources/edges/az-user-access-administrator.mdx b/docs/resources/edges/az-user-access-administrator.mdx index 97e97e62..a5a5dd58 100644 --- a/docs/resources/edges/az-user-access-administrator.mdx +++ b/docs/resources/edges/az-user-access-administrator.mdx @@ -9,7 +9,6 @@ import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; AZUserAccessAdministrator targets resources in Azure Resource Manager (for example [AZResourceGroup](/resources/nodes/az-resource-group), [AZSubscription](/resources/nodes/az-subscription), and [AZVM](/resources/nodes/az-vm)) through a role assignment called "User Access Administrator". -The edge terminates at the role assignment's scope. A role assignment scoped to an [AZManagementGroup](/resources/nodes/az-management-group), [AZSubscription](/resources/nodes/az-subscription), or [AZResourceGroup](/resources/nodes/az-resource-group) is inherited by all child resources. In BloodHound, that inheritance is traversable through the Azure Resource Manager hierarchy via [AZContains](/resources/edges/az-contains) edges. One scoped to a specific resource applies only to that resource. @@ -18,6 +17,7 @@ The edge terminates at the role assignment's scope. A role assignment scoped to The User Access Administrator role can manage access by assigning roles to principals within its scope. This role can be used to grant yourself or another principal any privilege you want against Automation Accounts, VMs, Key Vaults, and Resource Groups. For example, you can make yourself an administrator of an Azure Subscription by assigning the Owner role at the Subscription scope. +The edge terminates at the role assignment's scope. A role assignment scoped to an [AZManagementGroup](/resources/nodes/az-management-group), [AZSubscription](/resources/nodes/az-subscription), or [AZResourceGroup](/resources/nodes/az-resource-group) is inherited by all child resources. In BloodHound, that inheritance is traversable through the Azure Resource Manager hierarchy via [AZContains](/resources/edges/az-contains) edges. One scoped to a specific resource applies to that resource and, where applicable, its nested child resources. The simplest way to execute this attack is to use the Azure portal to add a new, abusable role assignment against the target object for yourself. From 0b9e49c26735f43dfd2766fdb9ca6515a157ec57 Mon Sep 17 00:00:00 2001 From: Martin Sohn Christensen Date: Thu, 27 Aug 2026 07:20:47 +0200 Subject: [PATCH 08/11] fix double-double quotes --- docs/resources/edges/az-owner.mdx | 2 +- docs/resources/edges/az-user-access-administrator.mdx | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/resources/edges/az-owner.mdx b/docs/resources/edges/az-owner.mdx index 628b17dd..006ceb00 100644 --- a/docs/resources/edges/az-owner.mdx +++ b/docs/resources/edges/az-owner.mdx @@ -1,6 +1,6 @@ --- title: AZOwner -description: "An Entra principal has been granted the Azure Resource Manager role called \\\"Owner\\\" over an Azure Resource Manager asset." +description: "An Entra principal has been granted the Azure Resource Manager 'Owner' role over an Azure Resource Manager asset." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-user-access-administrator.mdx b/docs/resources/edges/az-user-access-administrator.mdx index a5a5dd58..e7b12945 100644 --- a/docs/resources/edges/az-user-access-administrator.mdx +++ b/docs/resources/edges/az-user-access-administrator.mdx @@ -1,6 +1,6 @@ --- title: AZUserAccessAdministrator -description: "An Entra principal has been granted the Azure Resource Manager role called \\\"User Access Administrator\\\" over an Azure Resource Manager asset." +description: "An Entra principal has been granted the Azure Resource Manager 'User Access Administrator' role over an Azure Resource Manager asset." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; From 60378805799126d895d80c1a40291392f77e8731 Mon Sep 17 00:00:00 2001 From: Martin Sohn Christensen Date: Thu, 27 Aug 2026 07:27:33 +0200 Subject: [PATCH 09/11] add `description` to remaining AD nodes. --- docs/resources/nodes/ad-local-group.mdx | 2 +- docs/resources/nodes/computer.mdx | 1 + docs/resources/nodes/container.mdx | 2 +- docs/resources/nodes/domain.mdx | 2 +- docs/resources/nodes/gpo.mdx | 2 +- docs/resources/nodes/group.mdx | 1 + docs/resources/nodes/ou.mdx | 1 + docs/resources/nodes/user.mdx | 1 + 8 files changed, 8 insertions(+), 4 deletions(-) diff --git a/docs/resources/nodes/ad-local-group.mdx b/docs/resources/nodes/ad-local-group.mdx index d1d1ec62..71641536 100644 --- a/docs/resources/nodes/ad-local-group.mdx +++ b/docs/resources/nodes/ad-local-group.mdx @@ -1,5 +1,6 @@ --- title: ADLocalGroup +description: "The ADLocalGroup node represents a local group on a domain computer in Active Directory." icon: '/images/nodes/ad/ad-local-group.svg' --- @@ -42,4 +43,3 @@ The ADLocalGroup node represents a local group on a domain computer. | --- | --- | | **Edge type** | **Entity panel category** | | [LocalToComputer](/resources/edges/local-to-computer) | - | - diff --git a/docs/resources/nodes/computer.mdx b/docs/resources/nodes/computer.mdx index 6df6f4ff..30594e20 100644 --- a/docs/resources/nodes/computer.mdx +++ b/docs/resources/nodes/computer.mdx @@ -1,5 +1,6 @@ --- title: Computer +description: "The Computer node represents a computer in Active Directory." icon: '/images/nodes/ad/computer.svg' --- diff --git a/docs/resources/nodes/container.mdx b/docs/resources/nodes/container.mdx index 4f601624..cffa8946 100644 --- a/docs/resources/nodes/container.mdx +++ b/docs/resources/nodes/container.mdx @@ -1,5 +1,6 @@ --- title: Container +description: "The Container node represents a container in Active Directory." icon: '/images/nodes/ad/container.svg' --- @@ -23,4 +24,3 @@ import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; * [https://learn.microsoft.com/en-us/windows/win32/adschema/c-container](https://learn.microsoft.com/en-us/windows/win32/adschema/c-container) - diff --git a/docs/resources/nodes/domain.mdx b/docs/resources/nodes/domain.mdx index 1f94b1b8..a13459ab 100644 --- a/docs/resources/nodes/domain.mdx +++ b/docs/resources/nodes/domain.mdx @@ -1,5 +1,6 @@ --- title: Domain +description: "The Domain node represents a domain in Active Directory." icon: '/images/nodes/ad/domain.svg' --- @@ -26,4 +27,3 @@ import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; ## References * [https://learn.microsoft.com/en-us/windows/win32/adschema/c-domain](https://learn.microsoft.com/en-us/windows/win32/adschema/c-domain)  - diff --git a/docs/resources/nodes/gpo.mdx b/docs/resources/nodes/gpo.mdx index de947d14..09b70672 100644 --- a/docs/resources/nodes/gpo.mdx +++ b/docs/resources/nodes/gpo.mdx @@ -1,5 +1,6 @@ --- title: GPO +description: "The GPO node represents a Group Policy Object in Active Directory." icon: '/images/nodes/ad/gpo.svg' --- @@ -27,4 +28,3 @@ import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; ## References * [https://learn.microsoft.com/en-us/windows/win32/adschema/c-grouppolicycontainer](https://learn.microsoft.com/en-us/windows/win32/adschema/c-computer) - diff --git a/docs/resources/nodes/group.mdx b/docs/resources/nodes/group.mdx index 9b40897f..e503571f 100644 --- a/docs/resources/nodes/group.mdx +++ b/docs/resources/nodes/group.mdx @@ -1,5 +1,6 @@ --- title: Group +description: "The Group node represents a group in Active Directory." icon: '/images/nodes/ad/group.svg' --- diff --git a/docs/resources/nodes/ou.mdx b/docs/resources/nodes/ou.mdx index 30b80196..ef6d147e 100644 --- a/docs/resources/nodes/ou.mdx +++ b/docs/resources/nodes/ou.mdx @@ -1,5 +1,6 @@ --- title: OU +description: "The OU node represents an organizational unit in Active Directory." icon: '/images/nodes/ad/ou.svg' --- diff --git a/docs/resources/nodes/user.mdx b/docs/resources/nodes/user.mdx index 2fc35b88..5cbdcfbc 100644 --- a/docs/resources/nodes/user.mdx +++ b/docs/resources/nodes/user.mdx @@ -1,5 +1,6 @@ --- title: User +description: "The User node represents a user account in Active Directory." icon: '/images/nodes/ad/user.svg' --- From f55ff521850505faee2d5bbbad7b0f62e0da9b42 Mon Sep 17 00:00:00 2001 From: Martin Sohn Christensen Date: Thu, 27 Aug 2026 08:07:10 +0200 Subject: [PATCH 10/11] remove MS-deprecated AzureAD wording --- docs/resources/edges/az-add-owner.mdx | 2 +- docs/resources/edges/az-managed-identity.mdx | 2 +- docs/resources/edges/az-mg-add-owner.mdx | 2 +- docs/resources/edges/az-mg-grant-app-roles.mdx | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/resources/edges/az-add-owner.mdx b/docs/resources/edges/az-add-owner.mdx index 3406da6f..c1bf4ca3 100644 --- a/docs/resources/edges/az-add-owner.mdx +++ b/docs/resources/edges/az-add-owner.mdx @@ -46,7 +46,7 @@ New-AppOwner ` ``` ## Opsec Considerations -Any time you add an owner to any Azure object, the AzureAD audit logs will create an event logging who added an owner to what object, as well as what the new owner added to the object was. +Any time you add an owner to any object, the audit logs will create an event logging who added an owner to what object, as well as what the new owner added to the object was. ## References diff --git a/docs/resources/edges/az-managed-identity.mdx b/docs/resources/edges/az-managed-identity.mdx index c939bdcc..86350b6d 100644 --- a/docs/resources/edges/az-managed-identity.mdx +++ b/docs/resources/edges/az-managed-identity.mdx @@ -10,7 +10,7 @@ import AzureGenericAbuseLogOpsec from '/snippets/edges/azure-generic-abuse-log-o - This assignment allows the Azure resource to authenticate to Azure services as the Managed Identity without needing to know the credential for that Managed Identity. Managed Identities, whether System- or User-Assigned, are AzureAD Service Principals. + This assignment allows the Azure resource to authenticate to Azure services as the Managed Identity without needing to know the credential for that Managed Identity. Managed Identities, whether System- or User-Assigned, are Service Principals. ## Abuse Info diff --git a/docs/resources/edges/az-mg-add-owner.mdx b/docs/resources/edges/az-mg-add-owner.mdx index 9ab0e31c..bd7e952f 100644 --- a/docs/resources/edges/az-mg-add-owner.mdx +++ b/docs/resources/edges/az-mg-add-owner.mdx @@ -65,7 +65,7 @@ New-AppOwner ` ## Opsec Considerations -Any time you add an owner to any Azure object, the AzureAD audit logs will create an event logging who added an owner to what object, as well as what the new owner added to the object was. +Any time you add an owner to any object, the audit logs will create an event logging who added an owner to what object, as well as what the new owner added to the object was. ## References diff --git a/docs/resources/edges/az-mg-grant-app-roles.mdx b/docs/resources/edges/az-mg-grant-app-roles.mdx index 63ab6abe..b9a49cd4 100644 --- a/docs/resources/edges/az-mg-grant-app-roles.mdx +++ b/docs/resources/edges/az-mg-grant-app-roles.mdx @@ -8,7 +8,7 @@ import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; -It is created against AzureAD tenant objects when a Service Principal has one of the following MS Graph app role assignments: +It is created against tenant objects when a Service Principal has one of the following MS Graph app role assignments: * AppRoleAssignment.ReadWrite.All * RoleManagement.ReadWrite.Directory From d730f7629c645120b222e9ff2d403e5dd0470d76 Mon Sep 17 00:00:00 2001 From: Martin Sohn Christensen Date: Thu, 27 Aug 2026 08:07:42 +0200 Subject: [PATCH 11/11] description clarifications --- docs/resources/edges/az-mg-add-member.mdx | 2 +- docs/resources/edges/az-mg-add-owner.mdx | 2 +- docs/resources/edges/az-mg-add-secret.mdx | 2 +- .../resources/edges/az-mg-app-role-assignment-readwrite-all.mdx | 2 +- docs/resources/edges/az-mg-application-readwrite-all.mdx | 2 +- docs/resources/edges/az-mg-directory-readwrite-all.mdx | 2 +- docs/resources/edges/az-mg-grant-app-roles.mdx | 2 +- docs/resources/edges/az-mg-grant-role.mdx | 2 +- docs/resources/edges/az-mg-group-member-readwrite-all.mdx | 2 +- docs/resources/edges/az-mg-group-readwrite-all.mdx | 2 +- .../edges/az-mg-role-management-readwrite-directory.mdx | 2 +- .../edges/az-mg-service-principal-endpoint-readwrite-all.mdx | 2 +- docs/resources/edges/az-node-resource-group.mdx | 2 +- docs/resources/nodes/az-base.mdx | 2 +- docs/resources/nodes/az-federated-identity-credential.mdx | 2 +- docs/resources/nodes/az-tenant.mdx | 2 +- 16 files changed, 16 insertions(+), 16 deletions(-) diff --git a/docs/resources/edges/az-mg-add-member.mdx b/docs/resources/edges/az-mg-add-member.mdx index 0e9a0687..4f67fb1e 100644 --- a/docs/resources/edges/az-mg-add-member.mdx +++ b/docs/resources/edges/az-mg-add-member.mdx @@ -1,6 +1,6 @@ --- title: AZMGAddMember -description: "This edge is created during post-processing to represent an effective permission in Microsoft Entra ID." +description: "The ability to add principals to the target security group in Microsoft Entra ID." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-add-owner.mdx b/docs/resources/edges/az-mg-add-owner.mdx index bd7e952f..7b07f704 100644 --- a/docs/resources/edges/az-mg-add-owner.mdx +++ b/docs/resources/edges/az-mg-add-owner.mdx @@ -1,6 +1,6 @@ --- title: AZMGAddOwner -description: "This edge is created during post-processing to represent an effective permission in Microsoft Entra ID." +description: "The ability to add principals as owners of the target Microsoft Entra ID application, service principal, or security group." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-add-secret.mdx b/docs/resources/edges/az-mg-add-secret.mdx index 4adff3f4..f9427d6b 100644 --- a/docs/resources/edges/az-mg-add-secret.mdx +++ b/docs/resources/edges/az-mg-add-secret.mdx @@ -1,6 +1,6 @@ --- title: AZMGAddSecret -description: "This edge is created during post-processing to represent an effective permission in Microsoft Entra ID." +description: "The ability to add a client secret to the target Microsoft Entra ID application or service principal." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-app-role-assignment-readwrite-all.mdx b/docs/resources/edges/az-mg-app-role-assignment-readwrite-all.mdx index 24359869..3e961e61 100644 --- a/docs/resources/edges/az-mg-app-role-assignment-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-app-role-assignment-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGAppRoleAssignment_ReadWrite_All -description: "This edge is created when a service principal has been granted the AppRoleAssignment.ReadWrite.All Microsoft Entra ID app role." +description: "This edge is created when a service principal has been granted the AppRoleAssignment.ReadWrite.All Microsoft Graph application permission." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-application-readwrite-all.mdx b/docs/resources/edges/az-mg-application-readwrite-all.mdx index 2c5c9504..1e042cd6 100644 --- a/docs/resources/edges/az-mg-application-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-application-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGApplication_ReadWrite_All -description: "This edge is created when a service principal has been granted the Application.ReadWrite.All Microsoft Entra ID app role." +description: "This edge is created when a service principal has been granted the Application.ReadWrite.All Microsoft Graph application permission." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-directory-readwrite-all.mdx b/docs/resources/edges/az-mg-directory-readwrite-all.mdx index dbb73670..7408db50 100644 --- a/docs/resources/edges/az-mg-directory-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-directory-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGDirectory_ReadWrite_All -description: "This edge is created when a service principal has been granted the Directory.ReadWrite.All Microsoft Entra ID app role." +description: "This edge is created when a service principal has been granted the Directory.ReadWrite.All Microsoft Graph application permission." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-grant-app-roles.mdx b/docs/resources/edges/az-mg-grant-app-roles.mdx index b9a49cd4..6de7d5ec 100644 --- a/docs/resources/edges/az-mg-grant-app-roles.mdx +++ b/docs/resources/edges/az-mg-grant-app-roles.mdx @@ -1,6 +1,6 @@ --- title: AZMGGrantAppRoles -description: "This edge is created during post-processing to represent an effective permission in Microsoft Entra ID." +description: "The ability to grant Microsoft Entra ID app roles to service principals allows tenant compromise." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-grant-role.mdx b/docs/resources/edges/az-mg-grant-role.mdx index 13780915..ee3601c6 100644 --- a/docs/resources/edges/az-mg-grant-role.mdx +++ b/docs/resources/edges/az-mg-grant-role.mdx @@ -1,6 +1,6 @@ --- title: AZMGGrantRole -description: "This edge is created during post-processing to represent an effective permission in Microsoft Entra ID." +description: "The ability to assign principals to the target Microsoft Entra ID administrative role." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-group-member-readwrite-all.mdx b/docs/resources/edges/az-mg-group-member-readwrite-all.mdx index 87fbc610..920fad6a 100644 --- a/docs/resources/edges/az-mg-group-member-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-group-member-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGGroupMember_ReadWrite_All -description: "This edge is created when a service principal has been granted the GroupMember.ReadWrite.All Microsoft Entra ID app role." +description: "This edge is created when a service principal has been granted the GroupMember.ReadWrite.All Microsoft Graph application permission." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-group-readwrite-all.mdx b/docs/resources/edges/az-mg-group-readwrite-all.mdx index 90d73d07..75127448 100644 --- a/docs/resources/edges/az-mg-group-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-group-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGGroup_ReadWrite_All -description: "This edge is created when a service principal has been granted the Group.ReadWrite.All Microsoft Entra ID app role." +description: "This edge is created when a service principal has been granted the Group.ReadWrite.All Microsoft Graph application permission." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-role-management-readwrite-directory.mdx b/docs/resources/edges/az-mg-role-management-readwrite-directory.mdx index 2b500373..39702d36 100644 --- a/docs/resources/edges/az-mg-role-management-readwrite-directory.mdx +++ b/docs/resources/edges/az-mg-role-management-readwrite-directory.mdx @@ -1,6 +1,6 @@ --- title: AZMGRoleManagement_ReadWrite_Directory -description: "This edge is created when a service principal has been granted the RoleManagement.ReadWrite.Directory Microsoft Entra ID app role." +description: "This edge is created when a service principal has been granted the RoleManagement.ReadWrite.Directory Microsoft Graph application permission." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-mg-service-principal-endpoint-readwrite-all.mdx b/docs/resources/edges/az-mg-service-principal-endpoint-readwrite-all.mdx index 0f056680..6ba784f4 100644 --- a/docs/resources/edges/az-mg-service-principal-endpoint-readwrite-all.mdx +++ b/docs/resources/edges/az-mg-service-principal-endpoint-readwrite-all.mdx @@ -1,6 +1,6 @@ --- title: AZMGServicePrincipalEndpoint_ReadWrite_All -description: "This edge is created when a service principal has been granted the ServicePrincipalEndpoint.ReadWrite.All Microsoft Entra ID app role." +description: "This edge is created when a service principal has been granted the ServicePrincipalEndpoint.ReadWrite.All Microsoft Graph application permission." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/edges/az-node-resource-group.mdx b/docs/resources/edges/az-node-resource-group.mdx index cbbc51c5..b77227a3 100644 --- a/docs/resources/edges/az-node-resource-group.mdx +++ b/docs/resources/edges/az-node-resource-group.mdx @@ -1,6 +1,6 @@ --- title: AZNodeResourceGroup -description: "This Azure Resource Manager edge links Azure Kubernetes Service managed clusters to the virtual machine scale sets they use to execute commands." +description: "This Azure Resource Manager edge links Azure Kubernetes Service managed clusters to the virtual machine scale sets they use to execute commands." --- import ResourceEditionPill from '/snippets/resources/edition-pill.mdx'; diff --git a/docs/resources/nodes/az-base.mdx b/docs/resources/nodes/az-base.mdx index 47301c73..b701d61c 100644 --- a/docs/resources/nodes/az-base.mdx +++ b/docs/resources/nodes/az-base.mdx @@ -1,6 +1,6 @@ --- title: AZBase -description: "The AZBase node represents an unknown Microsoft Entra ID or Azure Resource Manager object." +description: "The AZBase node represents the basis for all other Microsoft Entra ID or Azure Resource Manager nodes." icon: '/images/nodes/azure/az-base.svg' --- diff --git a/docs/resources/nodes/az-federated-identity-credential.mdx b/docs/resources/nodes/az-federated-identity-credential.mdx index cee0b900..0276fbd7 100644 --- a/docs/resources/nodes/az-federated-identity-credential.mdx +++ b/docs/resources/nodes/az-federated-identity-credential.mdx @@ -1,6 +1,6 @@ --- title: AZFederatedIdentityCredential -description: "The AZFederatedIdentityCredential node represents a Federated Identity Credential configured on an application registration in Microsoft Entra ID." +description: "The AZFederatedIdentityCredential node represents a Federated Identity Credential configured on an application registration in Microsoft Entra ID, which allows an external identity provider to authenticate as the application without a password or certificate." icon: '/images/nodes/azure/az-federated-identity-credential.svg' --- diff --git a/docs/resources/nodes/az-tenant.mdx b/docs/resources/nodes/az-tenant.mdx index 863c5898..793d5539 100644 --- a/docs/resources/nodes/az-tenant.mdx +++ b/docs/resources/nodes/az-tenant.mdx @@ -1,6 +1,6 @@ --- title: AZTenant -description: "The AZTenant node represents a tenant in Microsoft Entra ID." +description: "The AZTenant node represents a Microsoft Entra tenant." icon: '/images/nodes/azure/az-tenant.svg' ---