# Choose the table-level RBAC scope before granting application access

> DSE recommends listing the tables and operations the principal needs before selecting an assignment scope.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-111-choose-the-table-level-rbac-scope-before-granting-application-access/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:09+00:00
- Modified: 2026-09-17T16:42:35+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 1 minutes

## What you need to know

DSE recommends listing the tables and operations the principal needs before selecting an assignment scope.

## Potentially affected

This guide applies to an application or operator receiving Microsoft Entra-based Azure Table Storage access when the required tables can be identified individually.

## DSE recommendation

DSE recommends listing the tables and operations the principal needs before selecting an assignment scope.

## Article

## Source facts

Microsoft documents table-level role scope as applying to one named table, while storage-account scope applies to every table in that account. Broader role assignments are inherited by resources below their scope. Entra-based Table access first authenticates the principal for a token, then uses that token to authorize the data request. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/tables/authorize-access-azure-active-directory)

## Applicability

This guide applies to an application or operator receiving Microsoft Entra-based Azure Table Storage access when the required tables can be identified individually.

## DSE recommendation

DSE recommends listing the tables and operations the principal needs before selecting an assignment scope. Use the narrowest scope that satisfies the approved requirement and inspect inherited grants that may already provide wider access. Record the principal object identifier and complete table resource identifier in the access request. Have the data owner confirm whether access to future tables in the same account is intended before approving any account-wide role.

## Verification

Run the permitted operation against the intended table and an approved negative test against an out-of-scope table. Compare results with the full effective role set. Capture authorization failures and unexpected access as findings, and do not treat a successful Entra sign-in alone as proof that table permissions have been configured correctly.

## Official references

- [Microsoft: Authorize access to tables using Active Directory – Azure Storage | Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/tables/authorize-access-azure-active-directory)

## Primary reference

- Name: Authorize access to tables using Active Directory - Azure Storage | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/storage/tables/authorize-access-azure-active-directory
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Choose the table-level RBAC scope before granting application access,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-111-choose-the-table-level-rbac-scope-before-granting-application-access/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.