How to secure "Azure Storage Queues" for each tenant?

Question

I'm building a queue messaging system in Azure and what I'm trying to do is an outbound message queue container in Azure Storage Queue that allows my desktop Windows Services to get the latest messages from that queue. The problem I'm facing is that I want to have multiple queues per tenant (each Windows service serves one client) in one storage account. As far as I see, there is no way to restrict the connection string access to each queue. On the other hand, it is not practical for me to create one storage account per tenant. What is the best way to restrict client access to one specific queue with the current security methods available in Azure? I was thinking about using Service Bus Queues, but even that doesn't solve the connection string issue I have in the client application.

Answer 1

I think service bus queues is your answer; they allow a multi-subscriber model with "subjects" and various filters etc.

Storage queues are very simplistic and are not the right answer for this particular scenario.

Sorry, on my mobile so haven't got all the relevant docs to hand.

Answer 2

One option is to use AAD identities and Storage's AAD authentication support (which is currently in public preview).

You would need a Service Principal in Azure AD for each tenant for this, and add the principal to the Storage Queue Data Reader or Storage Queue Data Contributor role on their respective queue.

You can then use the principal's credentials to get an access token that is tenant-specific.

Documentation:

https://azure.microsoft.com/en-us/blog/announcing-the-preview-of-aad-authentication-for-storage/

https://joonasw.net/view/azure-ad-authentication-with-azure-storage-and-managed-service-identity