{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-110-apply-a-queue-access-time-condition-to-every-relevant-role-assignment/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-110-apply-a-queue-access-time-condition-to-every-relevant-role-assignment/", "slug": "dse-20260917-110-apply-a-queue-access-time-condition-to-every-relevant-role-assignment", "url": "https://update.dsesecurity.com/updates/dse-20260917-110-apply-a-queue-access-time-condition-to-every-relevant-role-assignment/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-110-apply-a-queue-access-time-condition-to-every-relevant-role-assignment.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-110-apply-a-queue-access-time-condition-to-every-relevant-role-assignment/" }, "title": "Apply a Queue access-time condition to every relevant role assignment", "summary": "DSE recommends recording the queue, principal, intended UTC boundary, and relevant read grants before editing the condition.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:10+00:00", "modified_at": "2026-09-17T16:42:35+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 214, "potentially_affected": "Use this review when configuring a time-limited Queue Storage access scenario through Azure role assignment conditions for a principal with potentially multiple grants.", "dse_recommendation": "DSE recommends recording the queue, principal, intended UTC boundary, and relevant read grants before editing the condition.", "primary_source": { "name": "Examples for Azure role assignment conditions for Queue Storage - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-examples", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s Queue ABAC example combines a queue-name condition with a UTC time boundary to allow peeking only after a specified time. The guide requires the condition on every role assignment for the principal that includes the queue-message read action. Microsoft Learn

\n

Applicability

\n

Use this review when configuring a time-limited Queue Storage access scenario through Azure role assignment conditions for a principal with potentially multiple grants.

\n

DSE recommendation

\n

DSE recommends recording the queue, principal, intended UTC boundary, and relevant read grants before editing the condition. Review direct and inherited assignments in the agreed scope so the condition is not evaluated in isolation. Ask the access owner to approve the intended before-and-after behavior. Keep an explicit list of affected assignments and a recovery plan for an incorrectly restrictive change, rather than copying the sample’s queue name or date into production.

\n

Verification

\n

Use an approved test identity and queue to check the intended boundary and a queue outside the permitted scope. Compare observed access with the condition across all relevant grants. Retain the test time in UTC and the assignment identifiers. Leave an unexpected successful or denied request unresolved until the effective permission path is understood.

\n

Official references

\n", "content_text": "Source facts\nMicrosoft’s Queue ABAC example combines a queue-name condition with a UTC time boundary to allow peeking only after a specified time. The guide requires the condition on every role assignment for the principal that includes the queue-message read action. Microsoft Learn\nApplicability\nUse this review when configuring a time-limited Queue Storage access scenario through Azure role assignment conditions for a principal with potentially multiple grants.\nDSE recommendation\nDSE recommends recording the queue, principal, intended UTC boundary, and relevant read grants before editing the condition. Review direct and inherited assignments in the agreed scope so the condition is not evaluated in isolation. Ask the access owner to approve the intended before-and-after behavior. Keep an explicit list of affected assignments and a recovery plan for an incorrectly restrictive change, rather than copying the sample’s queue name or date into production.\nVerification\nUse an approved test identity and queue to check the intended boundary and a queue outside the permitted scope. Compare observed access with the condition across all relevant grants. Retain the test time in UTC and the assignment identifiers. Leave an unexpected successful or denied request unresolved until the effective permission path is understood.\nOfficial references\n\nMicrosoft: Examples for Azure role assignment conditions for Queue Storage – Azure Storage | Microsoft Learn", "content_markdown": "## Source facts\n\nMicrosoft’s Queue ABAC example combines a queue-name condition with a UTC time boundary to allow peeking only after a specified time. The guide requires the condition on every role assignment for the principal that includes the queue-message read action. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-examples)\n\n## Applicability\n\nUse this review when configuring a time-limited Queue Storage access scenario through Azure role assignment conditions for a principal with potentially multiple grants.\n\n## DSE recommendation\n\nDSE recommends recording the queue, principal, intended UTC boundary, and relevant read grants before editing the condition. Review direct and inherited assignments in the agreed scope so the condition is not evaluated in isolation. Ask the access owner to approve the intended before-and-after behavior. Keep an explicit list of affected assignments and a recovery plan for an incorrectly restrictive change, rather than copying the sample’s queue name or date into production.\n\n## Verification\n\nUse an approved test identity and queue to check the intended boundary and a queue outside the permitted scope. Compare observed access with the condition across all relevant grants. Retain the test time in UTC and the assignment identifiers. Leave an unexpected successful or denied request unresolved until the effective permission path is understood.\n\n## Official references\n\n- [Microsoft: Examples for Azure role assignment conditions for Queue Storage – Azure Storage | Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-examples)" }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-110-apply-a-queue-access-time-condition-to-every-relevant-role-assignment/", "url": "https://update.dsesecurity.com/updates/dse-20260917-110-apply-a-queue-access-time-condition-to-every-relevant-role-assignment/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-110-apply-a-queue-access-time-condition-to-every-relevant-role-assignment/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Apply a Queue access-time condition to every relevant role assignment", "item": "https://update.dsesecurity.com/updates/dse-20260917-110-apply-a-queue-access-time-condition-to-every-relevant-role-assignment/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-110-apply-a-queue-access-time-condition-to-every-relevant-role-assignment/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-110-apply-a-queue-access-time-condition-to-every-relevant-role-assignment/", "url": "https://update.dsesecurity.com/updates/dse-20260917-110-apply-a-queue-access-time-condition-to-every-relevant-role-assignment/", "headline": "Apply a Queue access-time condition to every relevant role assignment", "description": "DSE recommends recording the queue, principal, intended UTC boundary, and relevant read grants before editing the condition.", "abstract": "DSE recommends recording the queue, principal, intended UTC boundary, and relevant read grants before editing the condition.", "articleBody": "Source facts\nMicrosoft’s Queue ABAC example combines a queue-name condition with a UTC time boundary to allow peeking only after a specified time. The guide requires the condition on every role assignment for the principal that includes the queue-message read action. Microsoft Learn\nApplicability\nUse this review when configuring a time-limited Queue Storage access scenario through Azure role assignment conditions for a principal with potentially multiple grants.\nDSE recommendation\nDSE recommends recording the queue, principal, intended UTC boundary, and relevant read grants before editing the condition. Review direct and inherited assignments in the agreed scope so the condition is not evaluated in isolation. Ask the access owner to approve the intended before-and-after behavior. Keep an explicit list of affected assignments and a recovery plan for an incorrectly restrictive change, rather than copying the sample’s queue name or date into production.\nVerification\nUse an approved test identity and queue to check the intended boundary and a queue outside the permitted scope. Compare observed access with the condition across all relevant grants. Retain the test time in UTC and the assignment identifiers. Leave an unexpected successful or denied request unresolved until the effective permission path is understood.\nOfficial references\n\nMicrosoft: Examples for Azure role assignment conditions for Queue Storage – Azure Storage | Microsoft Learn", "datePublished": "2026-09-17T16:33:10+00:00", "dateModified": "2026-09-17T16:42:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-110-apply-a-queue-access-time-condition-to-every-relevant-role-assignment/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-110-apply-a-queue-access-time-condition-to-every-relevant-role-assignment/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Apply a Queue access-time condition to every relevant role assignment" }, "articleSection": [ "IT" ], "keywords": [ "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 214, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Examples for Azure role assignment conditions for Queue Storage - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-examples" } } ] } }