Match a Table SAS range to the intended tenant data slice

Source facts

Microsoft’s Table security guide describes SAS restrictions by partition-key and row-key ranges. Query, add, update, and delete permissions can be granted separately. Table entities do not have individual ACLs, so the guide calls for access boundaries to inform partitioning. Microsoft Learn

Applicability

Use this review when an application needs delegated access to a limited slice of Azure Table Storage data, such as one tenant’s rows, rather than to the whole table.

DSE recommendation

DSE recommends documenting the permitted partition and row boundaries alongside the exact operations the caller needs. Have the data owner confirm that the selected key ranges correspond to the intended data slice. Prepare positive and negative test entities near the range boundaries, and keep the token itself out of ordinary logs or review notes. Treat a query-only requirement as a reason to review every additional operation permission explicitly.

Verification

Using approved test data, verify access to an in-range entity and denial for entities beyond the intended boundary. Test only the requested operations and record any unexpected write or delete capability. Recheck the range after a key-design change, and keep unresolved isolation findings visible before the delegated access is accepted.

Official references

• Microsoft: Secure your Azure Table Storage | Microsoft Learn