Separate Queue Storage data permission from Azure portal navigation

Source facts

Queue data access through Entra requires a role explicitly granting data operations. Owner, Contributor, and Storage Account Contributor do not themselves grant queue-data access through Entra. A role that can list account keys can provide a different Shared Key access path.

For portal use, Microsoft also requires permission to navigate storage-account resources. A management role such as Reader at storage-account scope or above supplies that navigation permission; the queue-data roles do not supply it. Microsoft Learn.

Applicability

Review the intended user’s actual authentication path and required queue operations. Distinguish a portal-navigation failure from denial of a data operation, and inspect inherited assignments rather than considering only roles attached directly to the queue.

DSE recommendation

DSE recommends documenting the data role and navigation role as separate grants with separate purposes. Avoid adding broad Contributor access simply to make a portal view work. Ask the queue owner to approve the permitted operations and target queue, and account for any existing key-listing privilege during the review.

Verification

Using the intended Entra identity, test portal navigation and the approved queue operation independently. Also test an operation or queue outside the approved scope. Allow for documented role propagation before diagnosing a persistent denial, and confirm the test used Entra rather than account-key authorization. Preserve effective assignments and results, without copying message payloads unnecessarily.

Official references

Microsoft Learn: Authorize access to queues using Active Directory. Source retrieved September 9, 2026.