{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-182-limit-queue-abac-designs-to-supported-data-actions/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-182-limit-queue-abac-designs-to-supported-data-actions/", "slug": "dse-20260917-182-limit-queue-abac-designs-to-supported-data-actions", "url": "https://update.dsesecurity.com/updates/dse-20260917-182-limit-queue-abac-designs-to-supported-data-actions/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-182-limit-queue-abac-designs-to-supported-data-actions.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-182-limit-queue-abac-designs-to-supported-data-actions/" }, "title": "Limit Queue ABAC designs to supported data actions", "summary": "DSE recommends listing each requested operation before writing the condition.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:31:58+00:00", "modified_at": "2026-09-17T16:46:29+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 213, "potentially_affected": "This applies when a team proposes Azure Queue Storage ABAC conditions and needs to determine whether the intended operation is inside the supported authorization surface.", "dse_recommendation": "DSE recommends listing each requested operation before writing the condition.", "primary_source": { "name": "Authorize access to queues using Azure role assignment conditions - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft documents Queue role conditions for supported DataActions and explicitly excludes management Actions through the Storage resource provider. The supported built-in roles include Queue Data Contributor, Message Processor, Message Sender, and Data Reader. The guide says attribute-based rules require a consistent attribute taxonomy and protection of the attributes themselves. Microsoft Learn

\n

Applicability

\n

This applies when a team proposes Azure Queue Storage ABAC conditions and needs to determine whether the intended operation is inside the supported authorization surface.

\n

DSE recommendation

\n

DSE recommends listing each requested operation before writing the condition. Classify the relevant data action, role, resource scope, and attributes, and route account-management requirements to their appropriate authorization review. Assign owners for the attributes used by the condition so their values remain controlled. Keep the policy’s business meaning beside the technical expression and require a separate test for every materially different action it is intended to constrain.

\n

Verification

\n

Use an approved test principal to exercise the selected data operations against the intended resource and an out-of-scope case. Compare the results with the recorded role and condition. Document management permissions separately and avoid claiming that a successful Queue data-action test validates restrictions on storage-account administration.

\n

Official references

\n", "content_text": "Source facts\nMicrosoft documents Queue role conditions for supported DataActions and explicitly excludes management Actions through the Storage resource provider. The supported built-in roles include Queue Data Contributor, Message Processor, Message Sender, and Data Reader. The guide says attribute-based rules require a consistent attribute taxonomy and protection of the attributes themselves. Microsoft Learn\nApplicability\nThis applies when a team proposes Azure Queue Storage ABAC conditions and needs to determine whether the intended operation is inside the supported authorization surface.\nDSE recommendation\nDSE recommends listing each requested operation before writing the condition. Classify the relevant data action, role, resource scope, and attributes, and route account-management requirements to their appropriate authorization review. Assign owners for the attributes used by the condition so their values remain controlled. Keep the policy’s business meaning beside the technical expression and require a separate test for every materially different action it is intended to constrain.\nVerification\nUse an approved test principal to exercise the selected data operations against the intended resource and an out-of-scope case. Compare the results with the recorded role and condition. Document management permissions separately and avoid claiming that a successful Queue data-action test validates restrictions on storage-account administration.\nOfficial references\n\nMicrosoft: Authorize access to queues using Azure role assignment conditions – Azure Storage | Microsoft Learn", "content_markdown": "## Source facts\n\nMicrosoft documents Queue role conditions for supported DataActions and explicitly excludes management Actions through the Storage resource provider. The supported built-in roles include Queue Data Contributor, Message Processor, Message Sender, and Data Reader. The guide says attribute-based rules require a consistent attribute taxonomy and protection of the attributes themselves. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac)\n\n## Applicability\n\nThis applies when a team proposes Azure Queue Storage ABAC conditions and needs to determine whether the intended operation is inside the supported authorization surface.\n\n## DSE recommendation\n\nDSE recommends listing each requested operation before writing the condition. Classify the relevant data action, role, resource scope, and attributes, and route account-management requirements to their appropriate authorization review. Assign owners for the attributes used by the condition so their values remain controlled. Keep the policy’s business meaning beside the technical expression and require a separate test for every materially different action it is intended to constrain.\n\n## Verification\n\nUse an approved test principal to exercise the selected data operations against the intended resource and an out-of-scope case. Compare the results with the recorded role and condition. Document management permissions separately and avoid claiming that a successful Queue data-action test validates restrictions on storage-account administration.\n\n## Official references\n\n- [Microsoft: Authorize access to queues using Azure role assignment conditions – Azure Storage | Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac)" }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-182-limit-queue-abac-designs-to-supported-data-actions/", "url": "https://update.dsesecurity.com/updates/dse-20260917-182-limit-queue-abac-designs-to-supported-data-actions/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-182-limit-queue-abac-designs-to-supported-data-actions/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Limit Queue ABAC designs to supported data actions", "item": "https://update.dsesecurity.com/updates/dse-20260917-182-limit-queue-abac-designs-to-supported-data-actions/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-182-limit-queue-abac-designs-to-supported-data-actions/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-182-limit-queue-abac-designs-to-supported-data-actions/", "url": "https://update.dsesecurity.com/updates/dse-20260917-182-limit-queue-abac-designs-to-supported-data-actions/", "headline": "Limit Queue ABAC designs to supported data actions", "description": "DSE recommends listing each requested operation before writing the condition.", "abstract": "DSE recommends listing each requested operation before writing the condition.", "articleBody": "Source facts\nMicrosoft documents Queue role conditions for supported DataActions and explicitly excludes management Actions through the Storage resource provider. The supported built-in roles include Queue Data Contributor, Message Processor, Message Sender, and Data Reader. The guide says attribute-based rules require a consistent attribute taxonomy and protection of the attributes themselves. Microsoft Learn\nApplicability\nThis applies when a team proposes Azure Queue Storage ABAC conditions and needs to determine whether the intended operation is inside the supported authorization surface.\nDSE recommendation\nDSE recommends listing each requested operation before writing the condition. Classify the relevant data action, role, resource scope, and attributes, and route account-management requirements to their appropriate authorization review. Assign owners for the attributes used by the condition so their values remain controlled. Keep the policy’s business meaning beside the technical expression and require a separate test for every materially different action it is intended to constrain.\nVerification\nUse an approved test principal to exercise the selected data operations against the intended resource and an out-of-scope case. Compare the results with the recorded role and condition. Document management permissions separately and avoid claiming that a successful Queue data-action test validates restrictions on storage-account administration.\nOfficial references\n\nMicrosoft: Authorize access to queues using Azure role assignment conditions – Azure Storage | Microsoft Learn", "datePublished": "2026-09-17T16:31:58+00:00", "dateModified": "2026-09-17T16:46:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-182-limit-queue-abac-designs-to-supported-data-actions/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-182-limit-queue-abac-designs-to-supported-data-actions/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Limit Queue ABAC designs to supported data actions" }, "articleSection": [ "IT" ], "keywords": [ "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 213, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Authorize access to queues using Azure role assignment conditions - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac" } } ] } }