# Limit Queue ABAC designs to supported data actions

> DSE recommends listing each requested operation before writing the condition.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-182-limit-queue-abac-designs-to-supported-data-actions/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:31:58+00:00
- Modified: 2026-09-17T16:46:29+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 1 minutes

## What you need to know

DSE recommends listing each requested operation before writing the condition.

## Potentially affected

This applies when a team proposes Azure Queue Storage ABAC conditions and needs to determine whether the intended operation is inside the supported authorization surface.

## DSE recommendation

DSE recommends listing each requested operation before writing the condition.

## Article

## Source facts

Microsoft documents Queue role conditions for supported DataActions and explicitly excludes management Actions through the Storage resource provider. The supported built-in roles include Queue Data Contributor, Message Processor, Message Sender, and Data Reader. The guide says attribute-based rules require a consistent attribute taxonomy and protection of the attributes themselves. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac)

## Applicability

This applies when a team proposes Azure Queue Storage ABAC conditions and needs to determine whether the intended operation is inside the supported authorization surface.

## DSE recommendation

DSE recommends listing each requested operation before writing the condition. Classify the relevant data action, role, resource scope, and attributes, and route account-management requirements to their appropriate authorization review. Assign owners for the attributes used by the condition so their values remain controlled. Keep the policy’s business meaning beside the technical expression and require a separate test for every materially different action it is intended to constrain.

## Verification

Use an approved test principal to exercise the selected data operations against the intended resource and an out-of-scope case. Compare the results with the recorded role and condition. Document management permissions separately and avoid claiming that a successful Queue data-action test validates restrictions on storage-account administration.

## Official references

- [Microsoft: Authorize access to queues using Azure role assignment conditions – Azure Storage | Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac)

## Primary reference

- Name: Authorize access to queues using Azure role assignment conditions - Azure Storage | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Limit Queue ABAC designs to supported data actions,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-182-limit-queue-abac-designs-to-supported-data-actions/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.