Trace unexpected Queue CLI throttling to implicit account-key retrieval

Source facts

For Azure Queue CLI data operations, omitting auth-mode or selecting key makes the CLI attempt account-key authorization. If no key is supplied, the CLI requests it from the storage resource provider for each operation; many such calls can cause throttling. Microsoft recommends login mode for Entra authorization. A ReadOnly resource lock also prevents List Keys, so callers without a key must use Entra credentials. Microsoft Learn.

Applicability

Use this check for an approved Azure CLI script operating on Queue Storage. Identify the command’s effective authorization settings without printing credentials, connection strings or tokens into the diagnostic record.

DSE recommendation

Make the intended authorization mode explicit before increasing retries. Review the script and its environment with the owner to determine whether repeated key lookups are unintended. For an approved Entra-based workflow, confirm the required queue-data role and use the documented login mode. Keep resource-provider throttling separate from the queue operation’s own result. Do not remove a ReadOnly lock or distribute an account key merely to suppress an unexpected lookup failure.

Verification

Run a bounded authorized test and correlate the chosen mode with data-operation success and any resource-provider errors. Check that the intended identity has only the required queue permissions. Compare the result with the original failure before changing retry policy or workload volume. A successful CLI sign-in alone should not be treated as evidence that subsequent Queue commands avoided the account-key path.

Official references

Microsoft Learn: Choose how to authorize access to queue data with Azure CLI.