{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-111-choose-the-table-level-rbac-scope-before-granting-application-access/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-111-choose-the-table-level-rbac-scope-before-granting-application-access/", "slug": "dse-20260917-111-choose-the-table-level-rbac-scope-before-granting-application-access", "url": "https://update.dsesecurity.com/updates/dse-20260917-111-choose-the-table-level-rbac-scope-before-granting-application-access/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-111-choose-the-table-level-rbac-scope-before-granting-application-access.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-111-choose-the-table-level-rbac-scope-before-granting-application-access/" }, "title": "Choose the table-level RBAC scope before granting application access", "summary": "DSE recommends listing the tables and operations the principal needs before selecting an assignment scope.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:09+00:00", "modified_at": "2026-09-17T16:42:35+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 216, "potentially_affected": "This guide applies to an application or operator receiving Microsoft Entra-based Azure Table Storage access when the required tables can be identified individually.", "dse_recommendation": "DSE recommends listing the tables and operations the principal needs before selecting an assignment scope.", "primary_source": { "name": "Authorize access to tables using Active Directory - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/tables/authorize-access-azure-active-directory", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft documents table-level role scope as applying to one named table, while storage-account scope applies to every table in that account. Broader role assignments are inherited by resources below their scope. Entra-based Table access first authenticates the principal for a token, then uses that token to authorize the data request. Microsoft Learn

\n

Applicability

\n

This guide applies to an application or operator receiving Microsoft Entra-based Azure Table Storage access when the required tables can be identified individually.

\n

DSE recommendation

\n

DSE recommends listing the tables and operations the principal needs before selecting an assignment scope. Use the narrowest scope that satisfies the approved requirement and inspect inherited grants that may already provide wider access. Record the principal object identifier and complete table resource identifier in the access request. Have the data owner confirm whether access to future tables in the same account is intended before approving any account-wide role.

\n

Verification

\n

Run the permitted operation against the intended table and an approved negative test against an out-of-scope table. Compare results with the full effective role set. Capture authorization failures and unexpected access as findings, and do not treat a successful Entra sign-in alone as proof that table permissions have been configured correctly.

\n

Official references

\n", "content_text": "Source facts\nMicrosoft documents table-level role scope as applying to one named table, while storage-account scope applies to every table in that account. Broader role assignments are inherited by resources below their scope. Entra-based Table access first authenticates the principal for a token, then uses that token to authorize the data request. Microsoft Learn\nApplicability\nThis guide applies to an application or operator receiving Microsoft Entra-based Azure Table Storage access when the required tables can be identified individually.\nDSE recommendation\nDSE recommends listing the tables and operations the principal needs before selecting an assignment scope. Use the narrowest scope that satisfies the approved requirement and inspect inherited grants that may already provide wider access. Record the principal object identifier and complete table resource identifier in the access request. Have the data owner confirm whether access to future tables in the same account is intended before approving any account-wide role.\nVerification\nRun the permitted operation against the intended table and an approved negative test against an out-of-scope table. Compare results with the full effective role set. Capture authorization failures and unexpected access as findings, and do not treat a successful Entra sign-in alone as proof that table permissions have been configured correctly.\nOfficial references\n\nMicrosoft: Authorize access to tables using Active Directory – Azure Storage | Microsoft Learn", "content_markdown": "## Source facts\n\nMicrosoft documents table-level role scope as applying to one named table, while storage-account scope applies to every table in that account. Broader role assignments are inherited by resources below their scope. Entra-based Table access first authenticates the principal for a token, then uses that token to authorize the data request. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/tables/authorize-access-azure-active-directory)\n\n## Applicability\n\nThis guide applies to an application or operator receiving Microsoft Entra-based Azure Table Storage access when the required tables can be identified individually.\n\n## DSE recommendation\n\nDSE recommends listing the tables and operations the principal needs before selecting an assignment scope. Use the narrowest scope that satisfies the approved requirement and inspect inherited grants that may already provide wider access. Record the principal object identifier and complete table resource identifier in the access request. Have the data owner confirm whether access to future tables in the same account is intended before approving any account-wide role.\n\n## Verification\n\nRun the permitted operation against the intended table and an approved negative test against an out-of-scope table. Compare results with the full effective role set. Capture authorization failures and unexpected access as findings, and do not treat a successful Entra sign-in alone as proof that table permissions have been configured correctly.\n\n## Official references\n\n- [Microsoft: Authorize access to tables using Active Directory – Azure Storage | Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/tables/authorize-access-azure-active-directory)" }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-111-choose-the-table-level-rbac-scope-before-granting-application-access/", "url": "https://update.dsesecurity.com/updates/dse-20260917-111-choose-the-table-level-rbac-scope-before-granting-application-access/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-111-choose-the-table-level-rbac-scope-before-granting-application-access/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Choose the table-level RBAC scope before granting application access", "item": "https://update.dsesecurity.com/updates/dse-20260917-111-choose-the-table-level-rbac-scope-before-granting-application-access/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-111-choose-the-table-level-rbac-scope-before-granting-application-access/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-111-choose-the-table-level-rbac-scope-before-granting-application-access/", "url": "https://update.dsesecurity.com/updates/dse-20260917-111-choose-the-table-level-rbac-scope-before-granting-application-access/", "headline": "Choose the table-level RBAC scope before granting application access", "description": "DSE recommends listing the tables and operations the principal needs before selecting an assignment scope.", "abstract": "DSE recommends listing the tables and operations the principal needs before selecting an assignment scope.", "articleBody": "Source facts\nMicrosoft documents table-level role scope as applying to one named table, while storage-account scope applies to every table in that account. Broader role assignments are inherited by resources below their scope. Entra-based Table access first authenticates the principal for a token, then uses that token to authorize the data request. Microsoft Learn\nApplicability\nThis guide applies to an application or operator receiving Microsoft Entra-based Azure Table Storage access when the required tables can be identified individually.\nDSE recommendation\nDSE recommends listing the tables and operations the principal needs before selecting an assignment scope. Use the narrowest scope that satisfies the approved requirement and inspect inherited grants that may already provide wider access. Record the principal object identifier and complete table resource identifier in the access request. Have the data owner confirm whether access to future tables in the same account is intended before approving any account-wide role.\nVerification\nRun the permitted operation against the intended table and an approved negative test against an out-of-scope table. Compare results with the full effective role set. Capture authorization failures and unexpected access as findings, and do not treat a successful Entra sign-in alone as proof that table permissions have been configured correctly.\nOfficial references\n\nMicrosoft: Authorize access to tables using Active Directory – Azure Storage | Microsoft Learn", "datePublished": "2026-09-17T16:33:09+00:00", "dateModified": "2026-09-17T16:42:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-111-choose-the-table-level-rbac-scope-before-granting-application-access/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-111-choose-the-table-level-rbac-scope-before-granting-application-access/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose the table-level RBAC scope before granting application access" }, "articleSection": [ "IT" ], "keywords": [ "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 216, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Authorize access to tables using Active Directory - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/tables/authorize-access-azure-active-directory" } } ] } }