Apply a Queue access-time condition to every relevant role assignment

Source facts

Microsoft’s Queue ABAC example combines a queue-name condition with a UTC time boundary to allow peeking only after a specified time. The guide requires the condition on every role assignment for the principal that includes the queue-message read action. Microsoft Learn

Applicability

Use this review when configuring a time-limited Queue Storage access scenario through Azure role assignment conditions for a principal with potentially multiple grants.

DSE recommendation

DSE recommends recording the queue, principal, intended UTC boundary, and relevant read grants before editing the condition. Review direct and inherited assignments in the agreed scope so the condition is not evaluated in isolation. Ask the access owner to approve the intended before-and-after behavior. Keep an explicit list of affected assignments and a recovery plan for an incorrectly restrictive change, rather than copying the sample’s queue name or date into production.

Verification

Use an approved test identity and queue to check the intended boundary and a queue outside the permitted scope. Compare observed access with the condition across all relevant grants. Retain the test time in UTC and the assignment identifiers. Leave an unexpected successful or denied request unresolved until the effective permission path is understood.

Official references

• Microsoft: Examples for Azure role assignment conditions for Queue Storage – Azure Storage | Microsoft Learn