{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-433-trace-unexpected-queue-cli-throttling-to-implicit-account-key-retrieval/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-433-trace-unexpected-queue-cli-throttling-to-implicit-account-key-retrieval/", "slug": "dse-20260909-433-trace-unexpected-queue-cli-throttling-to-implicit-account-key-retrieval", "url": "https://update.dsesecurity.com/updates/dse-20260909-433-trace-unexpected-queue-cli-throttling-to-implicit-account-key-retrieval/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-433-trace-unexpected-queue-cli-throttling-to-implicit-account-key-retrieval.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-433-trace-unexpected-queue-cli-throttling-to-implicit-account-key-retrieval/" }, "title": "Trace unexpected Queue CLI throttling to implicit account-key retrieval", "summary": "Why can repeated Azure Queue data commands generate storage resource-provider calls?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:24:43+00:00", "modified_at": "2026-09-10T02:04:57+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 248, "potentially_affected": "Use this check for an approved Azure CLI script operating on Queue Storage. Identify the command's effective authorization settings without printing credentials, connection strings or tokens into the diagnostic record.", "dse_recommendation": "Make the intended authorization mode explicit before increasing retries.", "primary_source": { "name": "Choose how to authorize access to queue data with Azure CLI - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/queues/authorize-data-operations-cli", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For Azure Queue CLI data operations, omitting auth-mode or selecting key makes the CLI attempt account-key authorization. If no key is supplied, the CLI requests it from the storage resource provider for each operation; many such calls can cause throttling. Microsoft recommends login mode for Entra authorization. A ReadOnly resource lock also prevents List Keys, so callers without a key must use Entra credentials. Microsoft Learn.

\n

Applicability

\n

Use this check for an approved Azure CLI script operating on Queue Storage. Identify the command’s effective authorization settings without printing credentials, connection strings or tokens into the diagnostic record.

\n

DSE recommendation

\n

Make the intended authorization mode explicit before increasing retries. Review the script and its environment with the owner to determine whether repeated key lookups are unintended. For an approved Entra-based workflow, confirm the required queue-data role and use the documented login mode. Keep resource-provider throttling separate from the queue operation’s own result. Do not remove a ReadOnly lock or distribute an account key merely to suppress an unexpected lookup failure.

\n

Verification

\n

Run a bounded authorized test and correlate the chosen mode with data-operation success and any resource-provider errors. Check that the intended identity has only the required queue permissions. Compare the result with the original failure before changing retry policy or workload volume. A successful CLI sign-in alone should not be treated as evidence that subsequent Queue commands avoided the account-key path.

\n

Official references

\n

Microsoft Learn: Choose how to authorize access to queue data with Azure CLI.

", "content_text": "Source facts\nFor Azure Queue CLI data operations, omitting auth-mode or selecting key makes the CLI attempt account-key authorization. If no key is supplied, the CLI requests it from the storage resource provider for each operation; many such calls can cause throttling. Microsoft recommends login mode for Entra authorization. A ReadOnly resource lock also prevents List Keys, so callers without a key must use Entra credentials. Microsoft Learn.\nApplicability\nUse this check for an approved Azure CLI script operating on Queue Storage. Identify the command’s effective authorization settings without printing credentials, connection strings or tokens into the diagnostic record.\nDSE recommendation\nMake the intended authorization mode explicit before increasing retries. Review the script and its environment with the owner to determine whether repeated key lookups are unintended. For an approved Entra-based workflow, confirm the required queue-data role and use the documented login mode. Keep resource-provider throttling separate from the queue operation’s own result. Do not remove a ReadOnly lock or distribute an account key merely to suppress an unexpected lookup failure.\nVerification\nRun a bounded authorized test and correlate the chosen mode with data-operation success and any resource-provider errors. Check that the intended identity has only the required queue permissions. Compare the result with the original failure before changing retry policy or workload volume. A successful CLI sign-in alone should not be treated as evidence that subsequent Queue commands avoided the account-key path.\nOfficial references\nMicrosoft Learn: Choose how to authorize access to queue data with Azure CLI.", "content_markdown": "## Source facts\n\nFor Azure Queue CLI data operations, omitting auth-mode or selecting key makes the CLI attempt account-key authorization. If no key is supplied, the CLI requests it from the storage resource provider for each operation; many such calls can cause throttling. Microsoft recommends login mode for Entra authorization. A ReadOnly resource lock also prevents List Keys, so callers without a key must use Entra credentials. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/queues/authorize-data-operations-cli).\n\n## Applicability\n\nUse this check for an approved Azure CLI script operating on Queue Storage. Identify the command’s effective authorization settings without printing credentials, connection strings or tokens into the diagnostic record.\n\n## DSE recommendation\n\nMake the intended authorization mode explicit before increasing retries. Review the script and its environment with the owner to determine whether repeated key lookups are unintended. For an approved Entra-based workflow, confirm the required queue-data role and use the documented login mode. Keep resource-provider throttling separate from the queue operation’s own result. Do not remove a ReadOnly lock or distribute an account key merely to suppress an unexpected lookup failure.\n\n## Verification\n\nRun a bounded authorized test and correlate the chosen mode with data-operation success and any resource-provider errors. Check that the intended identity has only the required queue permissions. Compare the result with the original failure before changing retry policy or workload volume. A successful CLI sign-in alone should not be treated as evidence that subsequent Queue commands avoided the account-key path.\n\n## Official references\n\n[Microsoft Learn: Choose how to authorize access to queue data with Azure CLI](https://learn.microsoft.com/en-us/azure/storage/queues/authorize-data-operations-cli)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-433-trace-unexpected-queue-cli-throttling-to-implicit-account-key-retrieval/", "url": "https://update.dsesecurity.com/updates/dse-20260909-433-trace-unexpected-queue-cli-throttling-to-implicit-account-key-retrieval/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-433-trace-unexpected-queue-cli-throttling-to-implicit-account-key-retrieval/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Trace unexpected Queue CLI throttling to implicit account-key retrieval", "item": "https://update.dsesecurity.com/updates/dse-20260909-433-trace-unexpected-queue-cli-throttling-to-implicit-account-key-retrieval/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-433-trace-unexpected-queue-cli-throttling-to-implicit-account-key-retrieval/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-433-trace-unexpected-queue-cli-throttling-to-implicit-account-key-retrieval/", "url": "https://update.dsesecurity.com/updates/dse-20260909-433-trace-unexpected-queue-cli-throttling-to-implicit-account-key-retrieval/", "headline": "Trace unexpected Queue CLI throttling to implicit account-key retrieval", "description": "Why can repeated Azure Queue data commands generate storage resource-provider calls?", "abstract": "Why can repeated Azure Queue data commands generate storage resource-provider calls?", "articleBody": "Source facts\nFor Azure Queue CLI data operations, omitting auth-mode or selecting key makes the CLI attempt account-key authorization. If no key is supplied, the CLI requests it from the storage resource provider for each operation; many such calls can cause throttling. Microsoft recommends login mode for Entra authorization. A ReadOnly resource lock also prevents List Keys, so callers without a key must use Entra credentials. Microsoft Learn.\nApplicability\nUse this check for an approved Azure CLI script operating on Queue Storage. Identify the command’s effective authorization settings without printing credentials, connection strings or tokens into the diagnostic record.\nDSE recommendation\nMake the intended authorization mode explicit before increasing retries. Review the script and its environment with the owner to determine whether repeated key lookups are unintended. For an approved Entra-based workflow, confirm the required queue-data role and use the documented login mode. Keep resource-provider throttling separate from the queue operation’s own result. Do not remove a ReadOnly lock or distribute an account key merely to suppress an unexpected lookup failure.\nVerification\nRun a bounded authorized test and correlate the chosen mode with data-operation success and any resource-provider errors. Check that the intended identity has only the required queue permissions. Compare the result with the original failure before changing retry policy or workload volume. A successful CLI sign-in alone should not be treated as evidence that subsequent Queue commands avoided the account-key path.\nOfficial references\nMicrosoft Learn: Choose how to authorize access to queue data with Azure CLI.", "datePublished": "2026-09-10T00:24:43+00:00", "dateModified": "2026-09-10T02:04:57+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-433-trace-unexpected-queue-cli-throttling-to-implicit-account-key-retrieval/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-433-trace-unexpected-queue-cli-throttling-to-implicit-account-key-retrieval/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Trace unexpected Queue CLI throttling to implicit account-key retrieval" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 248, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Choose how to authorize access to queue data with Azure CLI - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/queues/authorize-data-operations-cli" } } ] } }