# Review the query-parameter boundary of an MSP metadata allowlist

> When does an MSP privilege apply to every request on a metadata path rather than one operation?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-142-review-the-query-parameter-boundary-of-an-msp-metadata-allowlist/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:29:34+00:00
- Modified: 2026-09-10T00:52:39+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

When does an MSP privilege apply to every request on a metadata path rather than one operation?

## Potentially affected

Owners designing custom in-guest metadata access rules with Metadata Security Protocol.

## DSE recommendation

Review each permitted path together with the query conditions and default-access behavior.

## Article

## Source facts

MSP privileges can identify an endpoint by its path and optional query parameters. Without query parameters, a privilege covers every value on that path. Matching is case-insensitive. With defaultAccess set to Allow, an endpoint becomes deny-by-default when a privilege exists for that resource. For query-qualified rules, extra request parameters do not prevent a match. Microsoft positions these controls as defense in depth, not a primary isolation boundary. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/metadata-security-protocol/advanced-configuration).

## Applicability

Use this review when turning observed metadata traffic into a custom allowlist. Identify the actual operations needed by each application rather than approving a shared path name without its request context.

## DSE recommendation

Review each permitted path together with the query conditions and default-access behavior. Have the application owner explain which requests should succeed and which should fail. Record why each privilege omits or includes query parameters. Keep the identity and role assignments alongside that decision so a narrowly written privilege is not evaluated in isolation from its callers.

## Verification

On a controlled workload, exercise an intended request, a request for a different operation on the same path, and a request containing an additional parameter. Compare observed authorization with the written expectation. Investigate surprises before broadening the allowlist, and preserve sanitized request shapes rather than tokens or response secrets.

## Official references

[Microsoft Learn: Advanced configuration for MSP](https://learn.microsoft.com/en-us/azure/virtual-machines/metadata-security-protocol/advanced-configuration). Source reviewed September 9, 2026.

## Primary reference

- Name: Advanced Configuration for MSP - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/metadata-security-protocol/advanced-configuration
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Review the query-parameter boundary of an MSP metadata allowlist,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-142-review-the-query-parameter-boundary-of-an-msp-metadata-allowlist/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.