# Test resource-context access before trusting Log Analytics row conditions

> Why might a reader still see unrestricted logs after a conditional Log Analytics role assignment is added?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-594-test-resource-context-access-before-trusting-log-analytics-row-conditions/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:22:02+00:00
- Modified: 2026-09-10T02:14:32+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Why might a reader still see unrestricted logs after a conditional Log Analytics role assignment is added?

## Potentially affected

Azure Monitor Log Analytics workspaces using granular RBAC conditions.

## DSE recommendation

Review additive role grants and every resource-context workspace access mode before accepting row-level restrictions.

## Article

## Source facts

Log Analytics granular RBAC is additive: a separate broader role grant can override the practical restriction of a conditional assignment. Microsoft also requires resource-context queries to use workspaces configured as Require workspace permissions, with ABAC applied to every relevant workspace. Under Use resources or workspace permissions, resource read permission grants access to all logs and bypasses workspace conditions. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/granular-rbac-log-analytics).

These conditions govern queries, not the exported data’s continuing access policy. LAQueryLogs can record whether a query used an applicable condition through ConditionalDataAccess, when query diagnostics are enabled. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/granular-rbac-log-analytics).

## Applicability

Use this review for Azure Monitor Log Analytics workspaces using granular RBAC conditions. Inventory every workspace contributing to the reader’s resource-context query, not just the workspace where the new assignment was created.

## DSE recommendation

DSE recommends testing with the intended reader’s complete effective role set. Identify broader grants before removing anything, and coordinate required changes with the access owner. Review the workspace access mode and conditions together. Maintain separate authorization for exported or replicated copies; do not assume a successful restricted query establishes the policy of downstream data.

## Verification

Choose known permitted and excluded records, then query through both the intended resource context and workspace context using the test identity. Compare visible rows with the approved conditions and inspect ConditionalDataAccess where available. Investigate any broader result before closing the access change. Retain the role assignments, workspace modes, query scope and observed rows as one reproducible test.

## Official references

[Microsoft Learn: Granular RBAC in Azure Monitor](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/granular-rbac-log-analytics).

## Primary reference

- Name: Granular RBAC - Azure Monitor Log Analytics | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/granular-rbac-log-analytics
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Test resource-context access before trusting Log Analytics row conditions,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-594-test-resource-context-access-before-trusting-log-analytics-row-conditions/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.