{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-097-validate-the-hosted-identity-separately-in-a-passwordless-queue-migration/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-097-validate-the-hosted-identity-separately-in-a-passwordless-queue-migration/", "slug": "dse-20260917-097-validate-the-hosted-identity-separately-in-a-passwordless-queue-migration", "url": "https://update.dsesecurity.com/updates/dse-20260917-097-validate-the-hosted-identity-separately-in-a-passwordless-queue-migration/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-097-validate-the-hosted-identity-separately-in-a-passwordless-queue-migration.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-097-validate-the-hosted-identity-separately-in-a-passwordless-queue-migration/" }, "title": "Validate the hosted identity separately in a passwordless Queue migration", "summary": "DSE recommends recording the expected local principal and the expected hosted principal as two separate entries in the migration plan.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:23+00:00", "modified_at": "2026-09-17T16:38:46+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 211, "potentially_affected": "Use this guide when an existing application is being migrated from a secret-based Queue Storage connection to the documented passwordless approach.", "dse_recommendation": "DSE recommends recording the expected local principal and the expected hosted principal as two separate entries in the migration plan.", "primary_source": { "name": "Migrate applications to use passwordless authentication with Azure Queue Storage - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/queues/passwordless-migrate-queues", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s migration guide configures a developer’s user permissions for local execution and then configures a managed identity for the deployed application. DefaultAzureCredential chooses among supported authentication methods at runtime, allowing local and deployed environments to use different methods. Microsoft Learn

\n

Applicability

\n

Use this guide when an existing application is being migrated from a secret-based Queue Storage connection to the documented passwordless approach.

\n

DSE recommendation

\n

DSE recommends recording the expected local principal and the expected hosted principal as two separate entries in the migration plan. Verify the intended hosted identity association and its required queue permissions before deployment. Ask the application owner to define a small end-to-end message test that can be repeated in both environments. Keep any old connection-secret retirement as a later controlled step after the deployed path has been validated.

\n

Verification

\n

Run the agreed test locally and again in the actual hosting environment. For each run, retain enough configuration evidence to identify the intended principal and target queue without exposing credentials or message content. Investigate a hosted authorization failure as its own finding, and do not infer deployment readiness solely from the developer’s successful local run.

\n

Official references

\n", "content_text": "Source facts\nMicrosoft’s migration guide configures a developer’s user permissions for local execution and then configures a managed identity for the deployed application. DefaultAzureCredential chooses among supported authentication methods at runtime, allowing local and deployed environments to use different methods. Microsoft Learn\nApplicability\nUse this guide when an existing application is being migrated from a secret-based Queue Storage connection to the documented passwordless approach.\nDSE recommendation\nDSE recommends recording the expected local principal and the expected hosted principal as two separate entries in the migration plan. Verify the intended hosted identity association and its required queue permissions before deployment. Ask the application owner to define a small end-to-end message test that can be repeated in both environments. Keep any old connection-secret retirement as a later controlled step after the deployed path has been validated.\nVerification\nRun the agreed test locally and again in the actual hosting environment. For each run, retain enough configuration evidence to identify the intended principal and target queue without exposing credentials or message content. Investigate a hosted authorization failure as its own finding, and do not infer deployment readiness solely from the developer’s successful local run.\nOfficial references\n\nMicrosoft: Migrate applications to use passwordless authentication with Azure Queue Storage – Azure Storage | Microsoft Learn", "content_markdown": "## Source facts\n\nMicrosoft’s migration guide configures a developer’s user permissions for local execution and then configures a managed identity for the deployed application. DefaultAzureCredential chooses among supported authentication methods at runtime, allowing local and deployed environments to use different methods. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/queues/passwordless-migrate-queues)\n\n## Applicability\n\nUse this guide when an existing application is being migrated from a secret-based Queue Storage connection to the documented passwordless approach.\n\n## DSE recommendation\n\nDSE recommends recording the expected local principal and the expected hosted principal as two separate entries in the migration plan. Verify the intended hosted identity association and its required queue permissions before deployment. Ask the application owner to define a small end-to-end message test that can be repeated in both environments. Keep any old connection-secret retirement as a later controlled step after the deployed path has been validated.\n\n## Verification\n\nRun the agreed test locally and again in the actual hosting environment. For each run, retain enough configuration evidence to identify the intended principal and target queue without exposing credentials or message content. Investigate a hosted authorization failure as its own finding, and do not infer deployment readiness solely from the developer’s successful local run.\n\n## Official references\n\n- [Microsoft: Migrate applications to use passwordless authentication with Azure Queue Storage – Azure Storage | Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/queues/passwordless-migrate-queues)" }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-097-validate-the-hosted-identity-separately-in-a-passwordless-queue-migration/", "url": "https://update.dsesecurity.com/updates/dse-20260917-097-validate-the-hosted-identity-separately-in-a-passwordless-queue-migration/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-097-validate-the-hosted-identity-separately-in-a-passwordless-queue-migration/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Validate the hosted identity separately in a passwordless Queue migration", "item": "https://update.dsesecurity.com/updates/dse-20260917-097-validate-the-hosted-identity-separately-in-a-passwordless-queue-migration/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-097-validate-the-hosted-identity-separately-in-a-passwordless-queue-migration/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-097-validate-the-hosted-identity-separately-in-a-passwordless-queue-migration/", "url": "https://update.dsesecurity.com/updates/dse-20260917-097-validate-the-hosted-identity-separately-in-a-passwordless-queue-migration/", "headline": "Validate the hosted identity separately in a passwordless Queue migration", "description": "DSE recommends recording the expected local principal and the expected hosted principal as two separate entries in the migration plan.", "abstract": "DSE recommends recording the expected local principal and the expected hosted principal as two separate entries in the migration plan.", "articleBody": "Source facts\nMicrosoft’s migration guide configures a developer’s user permissions for local execution and then configures a managed identity for the deployed application. DefaultAzureCredential chooses among supported authentication methods at runtime, allowing local and deployed environments to use different methods. Microsoft Learn\nApplicability\nUse this guide when an existing application is being migrated from a secret-based Queue Storage connection to the documented passwordless approach.\nDSE recommendation\nDSE recommends recording the expected local principal and the expected hosted principal as two separate entries in the migration plan. Verify the intended hosted identity association and its required queue permissions before deployment. Ask the application owner to define a small end-to-end message test that can be repeated in both environments. Keep any old connection-secret retirement as a later controlled step after the deployed path has been validated.\nVerification\nRun the agreed test locally and again in the actual hosting environment. For each run, retain enough configuration evidence to identify the intended principal and target queue without exposing credentials or message content. Investigate a hosted authorization failure as its own finding, and do not infer deployment readiness solely from the developer’s successful local run.\nOfficial references\n\nMicrosoft: Migrate applications to use passwordless authentication with Azure Queue Storage – Azure Storage | Microsoft Learn", "datePublished": "2026-09-17T16:33:23+00:00", "dateModified": "2026-09-17T16:38:46+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-097-validate-the-hosted-identity-separately-in-a-passwordless-queue-migration/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-097-validate-the-hosted-identity-separately-in-a-passwordless-queue-migration/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Validate the hosted identity separately in a passwordless Queue migration" }, "articleSection": [ "IT" ], "keywords": [ "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 211, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Migrate applications to use passwordless authentication with Azure Queue Storage - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/queues/passwordless-migrate-queues" } } ] } }