# Apply a Queue access-time condition to every relevant role assignment

> DSE recommends recording the queue, principal, intended UTC boundary, and relevant read grants before editing the condition.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-110-apply-a-queue-access-time-condition-to-every-relevant-role-assignment/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:10+00:00
- Modified: 2026-09-17T16:42:35+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 1 minutes

## What you need to know

DSE recommends recording the queue, principal, intended UTC boundary, and relevant read grants before editing the condition.

## Potentially affected

Use this review when configuring a time-limited Queue Storage access scenario through Azure role assignment conditions for a principal with potentially multiple grants.

## DSE recommendation

DSE recommends recording the queue, principal, intended UTC boundary, and relevant read grants before editing the condition.

## Article

## Source facts

Microsoft’s Queue ABAC example combines a queue-name condition with a UTC time boundary to allow peeking only after a specified time. The guide requires the condition on every role assignment for the principal that includes the queue-message read action. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-examples)

## Applicability

Use this review when configuring a time-limited Queue Storage access scenario through Azure role assignment conditions for a principal with potentially multiple grants.

## DSE recommendation

DSE recommends recording the queue, principal, intended UTC boundary, and relevant read grants before editing the condition. Review direct and inherited assignments in the agreed scope so the condition is not evaluated in isolation. Ask the access owner to approve the intended before-and-after behavior. Keep an explicit list of affected assignments and a recovery plan for an incorrectly restrictive change, rather than copying the sample’s queue name or date into production.

## Verification

Use an approved test identity and queue to check the intended boundary and a queue outside the permitted scope. Compare observed access with the condition across all relevant grants. Retain the test time in UTC and the assignment identifiers. Leave an unexpected successful or denied request unresolved until the effective permission path is understood.

## Official references

- [Microsoft: Examples for Azure role assignment conditions for Queue Storage – Azure Storage | Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-examples)

## Primary reference

- Name: Examples for Azure role assignment conditions for Queue Storage - Azure Storage | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-examples
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Apply a Queue access-time condition to every relevant role assignment,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-110-apply-a-queue-access-time-condition-to-every-relevant-role-assignment/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.