# Match a Table SAS range to the intended tenant data slice

> DSE recommends documenting the permitted partition and row boundaries alongside the exact operations the caller needs.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-123-match-a-table-sas-range-to-the-intended-tenant-data-slice/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:57+00:00
- Modified: 2026-09-17T16:42:36+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 1 minutes

## What you need to know

DSE recommends documenting the permitted partition and row boundaries alongside the exact operations the caller needs.

## Potentially affected

Use this review when an application needs delegated access to a limited slice of Azure Table Storage data, such as one tenant’s rows, rather than to the whole table.

## DSE recommendation

DSE recommends documenting the permitted partition and row boundaries alongside the exact operations the caller needs.

## Article

## Source facts

Microsoft’s Table security guide describes SAS restrictions by partition-key and row-key ranges. Query, add, update, and delete permissions can be granted separately. Table entities do not have individual ACLs, so the guide calls for access boundaries to inform partitioning. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/tables/secure-tables)

## Applicability

Use this review when an application needs delegated access to a limited slice of Azure Table Storage data, such as one tenant’s rows, rather than to the whole table.

## DSE recommendation

DSE recommends documenting the permitted partition and row boundaries alongside the exact operations the caller needs. Have the data owner confirm that the selected key ranges correspond to the intended data slice. Prepare positive and negative test entities near the range boundaries, and keep the token itself out of ordinary logs or review notes. Treat a query-only requirement as a reason to review every additional operation permission explicitly.

## Verification

Using approved test data, verify access to an in-range entity and denial for entities beyond the intended boundary. Test only the requested operations and record any unexpected write or delete capability. Recheck the range after a key-design change, and keep unresolved isolation findings visible before the delegated access is accepted.

## Official references

- [Microsoft: Secure your Azure Table Storage | Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/tables/secure-tables)

## Primary reference

- Name: Secure your Azure Table Storage | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/storage/tables/secure-tables
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Match a Table SAS range to the intended tenant data slice,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-123-match-a-table-sas-range-to-the-intended-tenant-data-slice/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.