Azure role-based access control (RBAC) now supports role assignment conditions for finer-grained access management. Conditions are written using the Azure Resource Manager (ARM) condition language and allow you to enforce specific rules (for example, limit access to particular blobs or queues).
However, conditional access in RBAC is currently available only for data actions in Azure Storage accounts and Azure Key Vault. According to the Microsoft Learn documentation for Azure Storage RBAC with conditions, the following services support conditional role assignments:
* Blob storage (containers and blobs)
* Queue storage
This means that you can apply conditions on containers (for blobs) and queues, but not on file shares or tables.
Conditions can restrict access to:
* Specific container names or blob prefixes.
* Specific queue names or messages.
For example, you could allow a user to read blobs only under a given prefix or queue, enhancing least- privilege control.
# Supported: Containers (Blob storage), Queues
# Not supported: File shares, Tables
Microsoft Azure Reference (Conceptual Summary):
"You can add conditions to Azure role assignments for blob and queue data actions. Conditions are not yet supported for Azure Files or Tables." (Source: Microsoft Learn - Azure role assignment conditions for storage data actions)