Choose the table-level RBAC scope before granting application access

Source facts

Microsoft documents table-level role scope as applying to one named table, while storage-account scope applies to every table in that account. Broader role assignments are inherited by resources below their scope. Entra-based Table access first authenticates the principal for a token, then uses that token to authorize the data request. Microsoft Learn

Applicability

This guide applies to an application or operator receiving Microsoft Entra-based Azure Table Storage access when the required tables can be identified individually.

DSE recommendation

DSE recommends listing the tables and operations the principal needs before selecting an assignment scope. Use the narrowest scope that satisfies the approved requirement and inspect inherited grants that may already provide wider access. Record the principal object identifier and complete table resource identifier in the access request. Have the data owner confirm whether access to future tables in the same account is intended before approving any account-wide role.

Verification

Run the permitted operation against the intended table and an approved negative test against an out-of-scope table. Compare results with the full effective role set. Capture authorization failures and unexpected access as findings, and do not treat a successful Entra sign-in alone as proof that table permissions have been configured correctly.

Official references

• Microsoft: Authorize access to tables using Active Directory – Azure Storage | Microsoft Learn