{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-139-separate-queue-storage-data-permission-from-azure-portal-navigation/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-139-separate-queue-storage-data-permission-from-azure-portal-navigation/", "slug": "dse-20260909-139-separate-queue-storage-data-permission-from-azure-portal-navigation", "url": "https://update.dsesecurity.com/updates/dse-20260909-139-separate-queue-storage-data-permission-from-azure-portal-navigation/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-139-separate-queue-storage-data-permission-from-azure-portal-navigation.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-139-separate-queue-storage-data-permission-from-azure-portal-navigation/" }, "title": "Separate Queue Storage data permission from Azure portal navigation", "summary": "Check both the queue-data role and the management-plane navigation role when a user works through the portal.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:29:37+00:00", "modified_at": "2026-09-10T00:52:39+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 234, "potentially_affected": "Users accessing Azure Queue Storage through the portal with Microsoft Entra authorization.", "dse_recommendation": "Review queue-data and portal-navigation permissions separately at the narrowest useful scopes.", "primary_source": { "name": "Authorize access to queues using Active Directory - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/queues/authorize-access-azure-active-directory", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Queue data access through Entra requires a role explicitly granting data operations. Owner, Contributor, and Storage Account Contributor do not themselves grant queue-data access through Entra. A role that can list account keys can provide a different Shared Key access path.

\n

For portal use, Microsoft also requires permission to navigate storage-account resources. A management role such as Reader at storage-account scope or above supplies that navigation permission; the queue-data roles do not supply it. Microsoft Learn.

\n

Applicability

\n

Review the intended user’s actual authentication path and required queue operations. Distinguish a portal-navigation failure from denial of a data operation, and inspect inherited assignments rather than considering only roles attached directly to the queue.

\n

DSE recommendation

\n

DSE recommends documenting the data role and navigation role as separate grants with separate purposes. Avoid adding broad Contributor access simply to make a portal view work. Ask the queue owner to approve the permitted operations and target queue, and account for any existing key-listing privilege during the review.

\n

Verification

\n

Using the intended Entra identity, test portal navigation and the approved queue operation independently. Also test an operation or queue outside the approved scope. Allow for documented role propagation before diagnosing a persistent denial, and confirm the test used Entra rather than account-key authorization. Preserve effective assignments and results, without copying message payloads unnecessarily.

\n

Official references

\n

Microsoft Learn: Authorize access to queues using Active Directory. Source retrieved September 9, 2026.

", "content_text": "Source facts\nQueue data access through Entra requires a role explicitly granting data operations. Owner, Contributor, and Storage Account Contributor do not themselves grant queue-data access through Entra. A role that can list account keys can provide a different Shared Key access path.\nFor portal use, Microsoft also requires permission to navigate storage-account resources. A management role such as Reader at storage-account scope or above supplies that navigation permission; the queue-data roles do not supply it. Microsoft Learn.\nApplicability\nReview the intended user’s actual authentication path and required queue operations. Distinguish a portal-navigation failure from denial of a data operation, and inspect inherited assignments rather than considering only roles attached directly to the queue.\nDSE recommendation\nDSE recommends documenting the data role and navigation role as separate grants with separate purposes. Avoid adding broad Contributor access simply to make a portal view work. Ask the queue owner to approve the permitted operations and target queue, and account for any existing key-listing privilege during the review.\nVerification\nUsing the intended Entra identity, test portal navigation and the approved queue operation independently. Also test an operation or queue outside the approved scope. Allow for documented role propagation before diagnosing a persistent denial, and confirm the test used Entra rather than account-key authorization. Preserve effective assignments and results, without copying message payloads unnecessarily.\nOfficial references\nMicrosoft Learn: Authorize access to queues using Active Directory. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nQueue data access through Entra requires a role explicitly granting data operations. Owner, Contributor, and Storage Account Contributor do not themselves grant queue-data access through Entra. A role that can list account keys can provide a different Shared Key access path.\n\nFor portal use, Microsoft also requires permission to navigate storage-account resources. A management role such as Reader at storage-account scope or above supplies that navigation permission; the queue-data roles do not supply it. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/queues/authorize-access-azure-active-directory).\n\n## Applicability\n\nReview the intended user’s actual authentication path and required queue operations. Distinguish a portal-navigation failure from denial of a data operation, and inspect inherited assignments rather than considering only roles attached directly to the queue.\n\n## DSE recommendation\n\nDSE recommends documenting the data role and navigation role as separate grants with separate purposes. Avoid adding broad Contributor access simply to make a portal view work. Ask the queue owner to approve the permitted operations and target queue, and account for any existing key-listing privilege during the review.\n\n## Verification\n\nUsing the intended Entra identity, test portal navigation and the approved queue operation independently. Also test an operation or queue outside the approved scope. Allow for documented role propagation before diagnosing a persistent denial, and confirm the test used Entra rather than account-key authorization. Preserve effective assignments and results, without copying message payloads unnecessarily.\n\n## Official references\n\n[Microsoft Learn: Authorize access to queues using Active Directory](https://learn.microsoft.com/en-us/azure/storage/queues/authorize-access-azure-active-directory). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-139-separate-queue-storage-data-permission-from-azure-portal-navigation/", "url": "https://update.dsesecurity.com/updates/dse-20260909-139-separate-queue-storage-data-permission-from-azure-portal-navigation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-139-separate-queue-storage-data-permission-from-azure-portal-navigation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Separate Queue Storage data permission from Azure portal navigation", "item": "https://update.dsesecurity.com/updates/dse-20260909-139-separate-queue-storage-data-permission-from-azure-portal-navigation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-139-separate-queue-storage-data-permission-from-azure-portal-navigation/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-139-separate-queue-storage-data-permission-from-azure-portal-navigation/", "url": "https://update.dsesecurity.com/updates/dse-20260909-139-separate-queue-storage-data-permission-from-azure-portal-navigation/", "headline": "Separate Queue Storage data permission from Azure portal navigation", "description": "Check both the queue-data role and the management-plane navigation role when a user works through the portal.", "abstract": "Check both the queue-data role and the management-plane navigation role when a user works through the portal.", "articleBody": "Source facts\nQueue data access through Entra requires a role explicitly granting data operations. Owner, Contributor, and Storage Account Contributor do not themselves grant queue-data access through Entra. A role that can list account keys can provide a different Shared Key access path.\nFor portal use, Microsoft also requires permission to navigate storage-account resources. A management role such as Reader at storage-account scope or above supplies that navigation permission; the queue-data roles do not supply it. Microsoft Learn.\nApplicability\nReview the intended user’s actual authentication path and required queue operations. Distinguish a portal-navigation failure from denial of a data operation, and inspect inherited assignments rather than considering only roles attached directly to the queue.\nDSE recommendation\nDSE recommends documenting the data role and navigation role as separate grants with separate purposes. Avoid adding broad Contributor access simply to make a portal view work. Ask the queue owner to approve the permitted operations and target queue, and account for any existing key-listing privilege during the review.\nVerification\nUsing the intended Entra identity, test portal navigation and the approved queue operation independently. Also test an operation or queue outside the approved scope. Allow for documented role propagation before diagnosing a persistent denial, and confirm the test used Entra rather than account-key authorization. Preserve effective assignments and results, without copying message payloads unnecessarily.\nOfficial references\nMicrosoft Learn: Authorize access to queues using Active Directory. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:29:37+00:00", "dateModified": "2026-09-10T00:52:39+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-139-separate-queue-storage-data-permission-from-azure-portal-navigation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-139-separate-queue-storage-data-permission-from-azure-portal-navigation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate Queue Storage data permission from Azure portal navigation" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 234, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Authorize access to queues using Active Directory - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/queues/authorize-access-azure-active-directory" } } ] } }