# Trace unexpected Queue CLI throttling to implicit account-key retrieval

> Why can repeated Azure Queue data commands generate storage resource-provider calls?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-433-trace-unexpected-queue-cli-throttling-to-implicit-account-key-retrieval/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:24:43+00:00
- Modified: 2026-09-10T02:04:57+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Why can repeated Azure Queue data commands generate storage resource-provider calls?

## Potentially affected

Use this check for an approved Azure CLI script operating on Queue Storage. Identify the command's effective authorization settings without printing credentials, connection strings or tokens into the diagnostic record.

## DSE recommendation

Make the intended authorization mode explicit before increasing retries.

## Article

## Source facts

For Azure Queue CLI data operations, omitting auth-mode or selecting key makes the CLI attempt account-key authorization. If no key is supplied, the CLI requests it from the storage resource provider for each operation; many such calls can cause throttling. Microsoft recommends login mode for Entra authorization. A ReadOnly resource lock also prevents List Keys, so callers without a key must use Entra credentials. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/queues/authorize-data-operations-cli).

## Applicability

Use this check for an approved Azure CLI script operating on Queue Storage. Identify the command’s effective authorization settings without printing credentials, connection strings or tokens into the diagnostic record.

## DSE recommendation

Make the intended authorization mode explicit before increasing retries. Review the script and its environment with the owner to determine whether repeated key lookups are unintended. For an approved Entra-based workflow, confirm the required queue-data role and use the documented login mode. Keep resource-provider throttling separate from the queue operation’s own result. Do not remove a ReadOnly lock or distribute an account key merely to suppress an unexpected lookup failure.

## Verification

Run a bounded authorized test and correlate the chosen mode with data-operation success and any resource-provider errors. Check that the intended identity has only the required queue permissions. Compare the result with the original failure before changing retry policy or workload volume. A successful CLI sign-in alone should not be treated as evidence that subsequent Queue commands avoided the account-key path.

## Official references

[Microsoft Learn: Choose how to authorize access to queue data with Azure CLI](https://learn.microsoft.com/en-us/azure/storage/queues/authorize-data-operations-cli).

## Primary reference

- Name: Choose how to authorize access to queue data with Azure CLI - Azure Storage | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/storage/queues/authorize-data-operations-cli
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Trace unexpected Queue CLI throttling to implicit account-key retrieval,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-433-trace-unexpected-queue-cli-throttling-to-implicit-account-key-retrieval/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.