docs: Clarify Azure node and edge documentation

docs/analyze-data/findings/table-view.mdx

@@ -86,8 +86,8 @@ flowchart LR
 
     subgraph active["Active findings"]
         direction TB
-        open["Open<br/>No active acceptance"]
-        accepted["Accepted<br/>Risk acceptance is active"]
+        open["<b>Open</b><br/>No active acceptance"]
+        accepted["<b>Accepted</b><br/>Risk acceptance is active"]
         open -->|"Accept risk"| accepted
         accepted -->|"Remove or expire<br/>acceptance"| open
     end
@@ -98,9 +98,9 @@ flowchart LR
     subgraph archived["System-archived outcomes"]
         direction TB
         systemChange{"System change"}
-        remediated["Remediated<br/>Analysis no longer detects the finding"]
-        orphaned["Orphaned<br/>Environment or OpenGraph extension<br/>archived or removed"]
-        deprecated["Deprecated<br/>Finding type removed from the schema"]
+        remediated["<b>Remediated</b><br/>Analysis no longer detects the finding"]
+        orphaned["<b>Orphaned</b><br/>Environment or OpenGraph extension<br/>archived or removed"]
+        deprecated["<b>Deprecated</b><br/>Finding type removed from the schema"]
         systemChange --> remediated
         systemChange --> orphaned
         systemChange --> deprecated

docs/resources/edges/az-add-members.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZAddMembers
-description: "The ability to add other principals to an Azure security group"
+description: "The ability to add principals to a security group in Microsoft Entra ID."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';

docs/resources/edges/az-add-owner.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZAddOwner
-description: "This edge is created during post-processing."
+description: "This edge is created during post-processing to represent ownership over an object in Microsoft Entra ID."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';
@@ -46,7 +46,7 @@ New-AppOwner `
 ```
 ## Opsec Considerations
 
-Any time you add an owner to any Azure object, the AzureAD audit logs will create an event logging who added an owner to what object, as well as what the new owner added to the object was.
+Any time you add an owner to any object, the audit logs will create an event logging who added an owner to what object, as well as what the new owner added to the object was.
 
 ## References
 

docs/resources/edges/az-add-secret.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZAddSecret
-description: Azure provides several systems and mechanisms for granting control of securable objects within Entra ID, including tenant-scoped admin roles, object-scoped admin roles, explicit object ownership, and API permissions.
+description: "Azure provides several systems and mechanisms for granting control of securable objects within Entra ID, including tenant-scoped admin roles, object-scoped admin roles, explicit object ownership, and API permissions."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';

docs/resources/edges/az-aks-contributor.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZAKSContributor
-description: "The Azure Kubernetes Service Contributor role grants full control of the target Azure Kubernetes Service Managed Cluster."
+description: "The Azure Kubernetes Service Contributor role in Azure Resource Manager grants full control of the target Azure Kubernetes Service managed cluster."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';
@@ -47,6 +47,7 @@ If successful, the output will include a JWT for the managed identity service pr
 
 ## References
 
+* [Azure Kubernetes Service Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/containers#azure-kubernetes-service-contributor-role)
 * [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK)
 * [https://www.netspi.com/blog/technical/cloud-penetration-testing/extract-credentials-from-azure-kubernetes-service/](https://www.netspi.com/blog/technical/cloud-penetration-testing/extract-credentials-from-azure-kubernetes-service/)
 * [https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/](https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/)

docs/resources/edges/az-authenticates-to.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZAuthenticatesTo
-description: The AZAuthenticatesTo edge indicates that a Federated Identity Credential (FIC) is configured on an Azure App Registration, allowing an external identity provider to authenticate as the application without a password or certificate.
+description: "The AZAuthenticatesTo edge indicates that a Federated Identity Credential (FIC) is configured on an application registration in Microsoft Entra ID, allowing an external identity provider to authenticate as the application without a password or certificate."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';

docs/resources/edges/az-automation-contributor.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZAutomationContributor
-description: The Azure Automation Contributor role grants full control of the target Azure Automation Account. This includes the ability to execute arbitrary commands on the Automation Account.
+description: "The Azure Automation Contributor role in Azure Resource Manager grants full control of the target Azure Automation account. This includes the ability to create and run a runbook that executes arbitrary commands in an Azure sandbox or on a configured Hybrid Runbook Worker."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';
@@ -50,7 +50,8 @@ If successful, the output will include a JWT for the managed identity service pr
 
 <AzureGenericAbuseLogOpsec />
 
-## References
-* [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK)
+## References
+* [Automation Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/management-and-governance#automation-contributor)
+* [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK)
 * [https://specterops.io/blog/2022/06/06/managed-identity-attack-paths-part-1-automation-accounts/](https://specterops.io/blog/2022/06/06/managed-identity-attack-paths-part-1-automation-accounts/)
 * [https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/](https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/)

docs/resources/edges/az-avere-contributor.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZAvereContributor
-description: Any principal granted the Avere Contributor role, scoped to the affected VM, can reset the built-in administrator password on the VM.
+description: "Any principal granted the Avere Contributor role in Azure Resource Manager, scoped to the affected VM, can reset the built-in administrator password on the VM."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';
@@ -26,4 +26,4 @@ Because you’ll be running a command as the SYSTEM user on the Virtual Machine,
 
 * [https://attack.mitre.org/tactics/TA0008/](https://attack.mitre.org/tactics/TA0008/)
 * [https://attack.mitre.org/techniques/T1021/](https://attack.mitre.org/techniques/T1021/)
-* [https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#avere-contributor](https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#avere-contributor)
+* [Avere Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage#avere-contributor)

docs/resources/edges/az-contains.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZContains
-description: "This indicates that the parent object contains the child object, such as a resource group containing a virtual machine, or a tenant “containing” a subscription."
+description: "This edge represents containment in Entra ID, or Azure Resource Manager hierarchy."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';

docs/resources/edges/az-contributor.mdx

@@ -1,18 +1,24 @@
 ---
 title: AZContributor
-description: "The contributor role grants almost all abusable privileges in all circumstances, with some exceptions. Those exceptions are not collected by AzureHound."
+description: "An Entra principal has been granted the Azure Resource Manager 'Contributor' role over an Azure Resource Manager asset."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';
 import AzureGenericAbuseLogOpsec from '/snippets/edges/azure-generic-abuse-log-opsec.mdx';
 
-<ResourceEditionPill />
-
-
-
-## Abuse Info
-
-This depends on what the target object is:
+<ResourceEditionPill />
+
+AZContributor targets resources in Azure Resource Manager (for example [AZResourceGroup](/resources/nodes/az-resource-group), [AZSubscription](/resources/nodes/az-subscription), and [AZVM](/resources/nodes/az-vm)) through a role assignment called "Contributor".
+
+
+
+
+## Abuse Info
+
+The Contributor role grants broad management access to Azure Resource Manager resources, but it cannot assign Azure RBAC roles or perform the operations excluded by its `NotActions` list.
+
+Abuse depends on the target object:
+The edge terminates at the role assignment's scope. A role assignment scoped to an [AZManagementGroup](/resources/nodes/az-management-group), [AZSubscription](/resources/nodes/az-subscription), or [AZResourceGroup](/resources/nodes/az-resource-group) is inherited by all child resources. In BloodHound, that inheritance is traversable through the Azure Resource Manager hierarchy via [AZContains](/resources/edges/az-contains) edges. One scoped to a specific resource applies to that resource and, where applicable, its nested child resources.
 
 * **Key Vault:**
     You can read secrets and alter access policies (grant yourself access to read secrets)
@@ -25,9 +31,10 @@ This depends on what the target object is:
 
 <AzureGenericAbuseLogOpsec />
 
-## References
-
-* [https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/](https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/)
+## References
+
+* [Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/privileged#contributor)
+* [https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/](https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/)
 * [https://blog.netspi.com/azure-automation-accounts-key-stores/](https://blog.netspi.com/azure-automation-accounts-key-stores/)
 * [https://blog.netspi.com/get-azurepasswords/](https://blog.netspi.com/get-azurepasswords/)
 * [https://blog.netspi.com/attacking-azure-cloud-shell/](https://blog.netspi.com/attacking-azure-cloud-shell/)

docs/resources/edges/az-execute-command.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZExecuteCommand
-description: "Principals with the Intune Administrators role are able to execute arbitrary PowerShell scripts on devices that are joined to the Azure tenant."
+description: "Principals with the Intune Administrator role in Microsoft Entra ID can execute arbitrary PowerShell scripts on Windows devices enrolled in and managed through Intune."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';

docs/resources/edges/az-get-certificates.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZGetCertificates
-description: "The ability to read certificates from key vaults."
+description: "The ability to read certificates from Azure Key Vault resources in Azure Resource Manager."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';

docs/resources/edges/az-get-keys.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZGetKeys
-description: "The ability to read keys from key vaults."
+description: "The ability to read keys from Azure Key Vault resources in Azure Resource Manager."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';

docs/resources/edges/az-get-secrets.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZGetSecrets
-description: "The ability to read secrets from key vaults."
+description: "The ability to read secrets from Azure Key Vault resources in Azure Resource Manager."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';

docs/resources/edges/az-has-role.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZHasRole
-description: The principal has an active assignment to the Entra ID role. This includes permanent assignments, and temporary assignments via Privileged Identity Management (PIM). If the principal is assigned eligibility via PIM the principal will also have an [AZRoleEligible](/resources/edges/az-role-eligible) edge to the role.
+description: "The principal has an active assignment to the Entra ID role. This includes permanent assignments, and temporary assignments via Privileged Identity Management (PIM). If the principal is assigned eligibility via PIM the principal will also have an [AZRoleEligible](/resources/edges/az-role-eligible) edge to the role."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';

docs/resources/edges/az-key-vault-contributor.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZKeyVaultKVContributor
-description: "The Key Vault Contributor role grants full control of the target Key Vault. This includes the ability to read all secrets stored on the Key Vault."
+description: "The Key Vault Contributor role in Azure Resource Manager grants full control of the target Key Vault. This includes the ability to read all secrets stored on the Key Vault."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';
@@ -24,6 +24,7 @@ Via PowerZure:
 
 ## References
 
+* [Key Vault Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/security#key-vault-contributor)
 * [https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/](https://blog.netspi.com/maintaining-azure-persistence-via-automation-accounts/)
 * [https://blog.netspi.com/azure-automation-accounts-key-stores/](https://blog.netspi.com/azure-automation-accounts-key-stores/)
 * [https://blog.netspi.com/get-azurepasswords/](https://blog.netspi.com/get-azurepasswords/)

docs/resources/edges/az-logic-app-contributor.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZLogicAppContributor
-description: The Logic Contributor role grants full control of the target Logic App. This includes the ability to execute arbitrary commands on the Logic App.
+description: "The Logic Contributor role in Azure Resource Manager grants full control of the target Logic App. This includes the ability to execute arbitrary commands on the Logic App."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';
@@ -18,8 +18,9 @@ You can see a full walkthrough for executing that abuse in this blog post: [And
 
 <AzureGenericAbuseLogOpsec />
 
-## References
-
-* [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK)
+## References
+
+* [Logic App Contributor](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/integration#logic-app-contributor)
+* [https://github.com/BloodHoundAD/BARK](https://github.com/BloodHoundAD/BARK)
 * [https://medium.com/p/52b29354fc54](https://medium.com/p/52b29354fc54)
 * [https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/](https://specterops.io/blog/2023/04/18/introducing-bloodhound-4-3-get-global-admin-more-often/)

docs/resources/edges/az-managed-identity.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZManagedIdentity
-description: "Azure resources like Virtual Machines, Logic Apps, and Automation Accounts can be assigned to either System- or User-Assigned Managed Identities."
+description: "Azure Resource Manager resources, such as virtual machines, Logic Apps, and Automation accounts, can be assigned system-assigned or user-assigned managed identities in Microsoft Entra ID."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';
@@ -10,7 +10,7 @@ import AzureGenericAbuseLogOpsec from '/snippets/edges/azure-generic-abuse-log-o
 
 
 
- This assignment allows the Azure resource to authenticate to Azure services as the Managed Identity without needing to know the credential for that Managed Identity. Managed Identities, whether System- or User-Assigned, are AzureAD Service Principals.
+ This assignment allows the Azure resource to authenticate to Azure services as the Managed Identity without needing to know the credential for that Managed Identity. Managed Identities, whether System- or User-Assigned, are Service Principals.
 
 ## Abuse Info
 

docs/resources/edges/az-member-of.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZMemberOf
-description: "The given asset is a member of the group."
+description: "The given Microsoft Entra ID asset is a member of the group."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';

docs/resources/edges/az-mg-add-member.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZMGAddMember
-description: "This edge is created during post-processing."
+description: "The ability to add principals to the target security group in Microsoft Entra ID."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';

docs/resources/edges/az-mg-add-owner.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZMGAddOwner
-description: "This edge is created during post-processing."
+description: "The ability to add principals as owners of the target Microsoft Entra ID application, service principal, or security group."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';
@@ -65,7 +65,7 @@ New-AppOwner `
 
 ## Opsec Considerations
 
-Any time you add an owner to any Azure object, the AzureAD audit logs will create an event logging who added an owner to what object, as well as what the new owner added to the object was.
+Any time you add an owner to any object, the audit logs will create an event logging who added an owner to what object, as well as what the new owner added to the object was.
 
 ## References
 

docs/resources/edges/az-mg-add-secret.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZMGAddSecret
-description: "This edge is created during post-processing."
+description: "The ability to add a client secret to the target Microsoft Entra ID application or service principal."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';

docs/resources/edges/az-mg-app-role-assignment-readwrite-all.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZMGAppRoleAssignment_ReadWrite_All
-description: "This edge is created when a Service Principal has been granted the AppRoleAssignment.ReadWrite.All edge."
+description: "This edge is created when a service principal has been granted the AppRoleAssignment.ReadWrite.All Microsoft Graph application permission."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';

docs/resources/edges/az-mg-application-readwrite-all.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZMGApplication_ReadWrite_All
-description: "This edge is created when a Service Principal has been granted the Application.ReadWrite.All edge."
+description: "This edge is created when a service principal has been granted the Application.ReadWrite.All Microsoft Graph application permission."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';

docs/resources/edges/az-mg-directory-readwrite-all.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZMGDirectory_ReadWrite_All
-description: "This edge is created when a Service Principal has been granted the Directory.ReadWrite.All edge."
+description: "This edge is created when a service principal has been granted the Directory.ReadWrite.All Microsoft Graph application permission."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';

docs/resources/edges/az-mg-grant-app-roles.mdx

@@ -1,14 +1,14 @@
 ---
 title: AZMGGrantAppRoles
-description: "This edge is created during post-processing."
+description: "The ability to grant Microsoft Entra ID app roles to service principals allows tenant compromise."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';
 
 <ResourceEditionPill />
 
 
-It is created against AzureAD tenant objects when a Service Principal has one of the following MS Graph app role assignments:
+It is created against tenant objects when a Service Principal has one of the following MS Graph app role assignments:
 
 * AppRoleAssignment.ReadWrite.All
 * RoleManagement.ReadWrite.Directory

docs/resources/edges/az-mg-grant-role.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZMGGrantRole
-description: "This edge is created during post-processing."
+description: "The ability to assign principals to the target Microsoft Entra ID administrative role."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';

docs/resources/edges/az-mg-group-member-readwrite-all.mdx

@@ -1,6 +1,6 @@
 ---
 title: AZMGGroupMember_ReadWrite_All
-description: "This edge is created when a Service Principal has been granted the GroupMember.ReadWrite.All edge."
+description: "This edge is created when a service principal has been granted the GroupMember.ReadWrite.All Microsoft Graph application permission."
 ---
 
 import ResourceEditionPill from '/snippets/resources/edition-pill.mdx';