Document Details
Queues Auth Abac Examples
❌
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Bias Types:
⚠️
powershell_heavy
⚠️
missing_linux_example
⚠️
windows_tools
Summary:
The documentation provides detailed step-by-step examples for using the Azure portal and Azure PowerShell to add and test role assignment conditions for Azure Queue Storage. However, it does not include any examples or guidance for Linux users, such as using Azure CLI (which is cross-platform) or shell scripting. All command-line examples are exclusively in PowerShell, a tool most commonly associated with Windows environments, and there is no mention of Bash, Azure CLI, or other Linux-native tools.
Recommendations:
- Add equivalent Azure CLI examples for all PowerShell command snippets, as Azure CLI is cross-platform and widely used on Linux and macOS.
- Explicitly mention that the steps can be performed on Linux and macOS using Azure CLI, and provide guidance or links for those platforms.
- Where possible, provide Bash or shell script examples alongside PowerShell, especially for testing and automation tasks.
- Avoid assuming PowerShell as the default scripting environment; present PowerShell and Azure CLI examples side-by-side or in separate tabs.
- Include a note in the prerequisites or introduction clarifying tool support across operating systems.
Create pull request
Scan History
| Date | Scan ID | Status | Bias Status |
|---|---|---|---|
| 2025-08-19 00:01 | #85 | completed | ✅ Clean |
| 2025-07-13 21:37 | #48 | completed | ❌ Biased |
| 2025-07-12 23:44 | #41 | in_progress | ❌ Biased |
Flagged Code Snippets
$subId = "<your subscription id>"
$rgName = "<resource group name>"
$storageAccountName = "<storage account name>"
$roleDefinitionName = "Storage Queue Data Reader"
$userUpn = "<user UPN>"
$userObjectID = (Get-AzADUser -UserPrincipalName $userUpn).Id
$queueName = "sample-queue"
$dateTime = "2023-05-01T13:00:00.000Z"
$scope = "/subscriptions/$subId/resourceGroups/$rgName/providers/Microsoft.Storage/storageAccounts/$storageAccountName"
$condition = `
"( `
( `
!(ActionMatches{'Microsoft.Storage/storageAccounts/queueServices/queues/messages/read'}) `
) `
OR `
( `
@Resource[Microsoft.Storage/storageAccounts/queueServices/queues:name] StringEquals '$queueName' `
AND `
@Environment[UtcNow] DateTimeGreaterThan '$dateTime' `
) `
)"
$testRa = Get-AzRoleAssignment -Scope $scope -RoleDefinitionName $roleDefinitionName -ObjectId $userObjectID
$testRa.Condition = $condition
$testRa.ConditionVersion = "2.0"
Set-AzRoleAssignment -InputObject $testRa -PassThru