{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-123-match-a-table-sas-range-to-the-intended-tenant-data-slice/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-123-match-a-table-sas-range-to-the-intended-tenant-data-slice/", "slug": "dse-20260917-123-match-a-table-sas-range-to-the-intended-tenant-data-slice", "url": "https://update.dsesecurity.com/updates/dse-20260917-123-match-a-table-sas-range-to-the-intended-tenant-data-slice/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-123-match-a-table-sas-range-to-the-intended-tenant-data-slice.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-123-match-a-table-sas-range-to-the-intended-tenant-data-slice/" }, "title": "Match a Table SAS range to the intended tenant data slice", "summary": "DSE recommends documenting the permitted partition and row boundaries alongside the exact operations the caller needs.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:57+00:00", "modified_at": "2026-09-17T16:42:36+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 206, "potentially_affected": "Use this review when an application needs delegated access to a limited slice of Azure Table Storage data, such as one tenant’s rows, rather than to the whole table.", "dse_recommendation": "DSE recommends documenting the permitted partition and row boundaries alongside the exact operations the caller needs.", "primary_source": { "name": "Secure your Azure Table Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/tables/secure-tables", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s Table security guide describes SAS restrictions by partition-key and row-key ranges. Query, add, update, and delete permissions can be granted separately. Table entities do not have individual ACLs, so the guide calls for access boundaries to inform partitioning. Microsoft Learn

\n

Applicability

\n

Use this review when an application needs delegated access to a limited slice of Azure Table Storage data, such as one tenant’s rows, rather than to the whole table.

\n

DSE recommendation

\n

DSE recommends documenting the permitted partition and row boundaries alongside the exact operations the caller needs. Have the data owner confirm that the selected key ranges correspond to the intended data slice. Prepare positive and negative test entities near the range boundaries, and keep the token itself out of ordinary logs or review notes. Treat a query-only requirement as a reason to review every additional operation permission explicitly.

\n

Verification

\n

Using approved test data, verify access to an in-range entity and denial for entities beyond the intended boundary. Test only the requested operations and record any unexpected write or delete capability. Recheck the range after a key-design change, and keep unresolved isolation findings visible before the delegated access is accepted.

\n

Official references

\n", "content_text": "Source facts\nMicrosoft’s Table security guide describes SAS restrictions by partition-key and row-key ranges. Query, add, update, and delete permissions can be granted separately. Table entities do not have individual ACLs, so the guide calls for access boundaries to inform partitioning. Microsoft Learn\nApplicability\nUse this review when an application needs delegated access to a limited slice of Azure Table Storage data, such as one tenant’s rows, rather than to the whole table.\nDSE recommendation\nDSE recommends documenting the permitted partition and row boundaries alongside the exact operations the caller needs. Have the data owner confirm that the selected key ranges correspond to the intended data slice. Prepare positive and negative test entities near the range boundaries, and keep the token itself out of ordinary logs or review notes. Treat a query-only requirement as a reason to review every additional operation permission explicitly.\nVerification\nUsing approved test data, verify access to an in-range entity and denial for entities beyond the intended boundary. Test only the requested operations and record any unexpected write or delete capability. Recheck the range after a key-design change, and keep unresolved isolation findings visible before the delegated access is accepted.\nOfficial references\n\nMicrosoft: Secure your Azure Table Storage | Microsoft Learn", "content_markdown": "## Source facts\n\nMicrosoft’s Table security guide describes SAS restrictions by partition-key and row-key ranges. Query, add, update, and delete permissions can be granted separately. Table entities do not have individual ACLs, so the guide calls for access boundaries to inform partitioning. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/tables/secure-tables)\n\n## Applicability\n\nUse this review when an application needs delegated access to a limited slice of Azure Table Storage data, such as one tenant’s rows, rather than to the whole table.\n\n## DSE recommendation\n\nDSE recommends documenting the permitted partition and row boundaries alongside the exact operations the caller needs. Have the data owner confirm that the selected key ranges correspond to the intended data slice. Prepare positive and negative test entities near the range boundaries, and keep the token itself out of ordinary logs or review notes. Treat a query-only requirement as a reason to review every additional operation permission explicitly.\n\n## Verification\n\nUsing approved test data, verify access to an in-range entity and denial for entities beyond the intended boundary. Test only the requested operations and record any unexpected write or delete capability. Recheck the range after a key-design change, and keep unresolved isolation findings visible before the delegated access is accepted.\n\n## Official references\n\n- [Microsoft: Secure your Azure Table Storage | Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/tables/secure-tables)" }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-123-match-a-table-sas-range-to-the-intended-tenant-data-slice/", "url": "https://update.dsesecurity.com/updates/dse-20260917-123-match-a-table-sas-range-to-the-intended-tenant-data-slice/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-123-match-a-table-sas-range-to-the-intended-tenant-data-slice/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Match a Table SAS range to the intended tenant data slice", "item": "https://update.dsesecurity.com/updates/dse-20260917-123-match-a-table-sas-range-to-the-intended-tenant-data-slice/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-123-match-a-table-sas-range-to-the-intended-tenant-data-slice/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-123-match-a-table-sas-range-to-the-intended-tenant-data-slice/", "url": "https://update.dsesecurity.com/updates/dse-20260917-123-match-a-table-sas-range-to-the-intended-tenant-data-slice/", "headline": "Match a Table SAS range to the intended tenant data slice", "description": "DSE recommends documenting the permitted partition and row boundaries alongside the exact operations the caller needs.", "abstract": "DSE recommends documenting the permitted partition and row boundaries alongside the exact operations the caller needs.", "articleBody": "Source facts\nMicrosoft’s Table security guide describes SAS restrictions by partition-key and row-key ranges. Query, add, update, and delete permissions can be granted separately. Table entities do not have individual ACLs, so the guide calls for access boundaries to inform partitioning. Microsoft Learn\nApplicability\nUse this review when an application needs delegated access to a limited slice of Azure Table Storage data, such as one tenant’s rows, rather than to the whole table.\nDSE recommendation\nDSE recommends documenting the permitted partition and row boundaries alongside the exact operations the caller needs. Have the data owner confirm that the selected key ranges correspond to the intended data slice. Prepare positive and negative test entities near the range boundaries, and keep the token itself out of ordinary logs or review notes. Treat a query-only requirement as a reason to review every additional operation permission explicitly.\nVerification\nUsing approved test data, verify access to an in-range entity and denial for entities beyond the intended boundary. Test only the requested operations and record any unexpected write or delete capability. Recheck the range after a key-design change, and keep unresolved isolation findings visible before the delegated access is accepted.\nOfficial references\n\nMicrosoft: Secure your Azure Table Storage | Microsoft Learn", "datePublished": "2026-09-17T16:32:57+00:00", "dateModified": "2026-09-17T16:42:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-123-match-a-table-sas-range-to-the-intended-tenant-data-slice/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-123-match-a-table-sas-range-to-the-intended-tenant-data-slice/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Match a Table SAS range to the intended tenant data slice" }, "articleSection": [ "IT" ], "keywords": [ "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 206, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Secure your Azure Table Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/tables/secure-tables" } } ] } }