# Separate Queue Storage data permission from Azure portal navigation

> Check both the queue-data role and the management-plane navigation role when a user works through the portal.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-139-separate-queue-storage-data-permission-from-azure-portal-navigation/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:29:37+00:00
- Modified: 2026-09-10T00:52:39+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Check both the queue-data role and the management-plane navigation role when a user works through the portal.

## Potentially affected

Users accessing Azure Queue Storage through the portal with Microsoft Entra authorization.

## DSE recommendation

Review queue-data and portal-navigation permissions separately at the narrowest useful scopes.

## Article

## Source facts

Queue data access through Entra requires a role explicitly granting data operations. Owner, Contributor, and Storage Account Contributor do not themselves grant queue-data access through Entra. A role that can list account keys can provide a different Shared Key access path.

For portal use, Microsoft also requires permission to navigate storage-account resources. A management role such as Reader at storage-account scope or above supplies that navigation permission; the queue-data roles do not supply it. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/queues/authorize-access-azure-active-directory).

## Applicability

Review the intended user’s actual authentication path and required queue operations. Distinguish a portal-navigation failure from denial of a data operation, and inspect inherited assignments rather than considering only roles attached directly to the queue.

## DSE recommendation

DSE recommends documenting the data role and navigation role as separate grants with separate purposes. Avoid adding broad Contributor access simply to make a portal view work. Ask the queue owner to approve the permitted operations and target queue, and account for any existing key-listing privilege during the review.

## Verification

Using the intended Entra identity, test portal navigation and the approved queue operation independently. Also test an operation or queue outside the approved scope. Allow for documented role propagation before diagnosing a persistent denial, and confirm the test used Entra rather than account-key authorization. Preserve effective assignments and results, without copying message payloads unnecessarily.

## Official references

[Microsoft Learn: Authorize access to queues using Active Directory](https://learn.microsoft.com/en-us/azure/storage/queues/authorize-access-azure-active-directory). Source retrieved September 9, 2026.

## Primary reference

- Name: Authorize access to queues using Active Directory - Azure Storage | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/storage/queues/authorize-access-azure-active-directory
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate Queue Storage data permission from Azure portal navigation,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-139-separate-queue-storage-data-permission-from-azure-portal-navigation/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.