{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-053-match-incremental-snapshots-to-the-disk-instance-not-just-its-reused-name/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-053-match-incremental-snapshots-to-the-disk-instance-not-just-its-reused-name/", "slug": "dse-20260909-053-match-incremental-snapshots-to-the-disk-instance-not-just-its-reused-name", "url": "https://update.dsesecurity.com/updates/dse-20260909-053-match-incremental-snapshots-to-the-disk-instance-not-just-its-reused-name/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-053-match-incremental-snapshots-to-the-disk-instance-not-just-its-reused-name.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-053-match-incremental-snapshots-to-the-disk-instance-not-just-its-reused-name/" }, "title": "Match incremental snapshots to the disk instance, not just its reused name", "summary": "How can a snapshot inventory distinguish a recreated Azure disk from its predecessor?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:31:03+00:00", "modified_at": "2026-09-10T00:35:07+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 246, "potentially_affected": "Operators inventorying incremental snapshots for Azure managed disks that might be deleted and recreated under the same name.", "dse_recommendation": "Match both the source resource ID and source unique ID when assigning snapshots to a particular disk instance.", "primary_source": { "name": "Create an incremental snapshot - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/disks-incremental-snapshots", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure incremental snapshots expose SourceResourceId for the source disk’s resource identity and SourceUniqueId inherited from the disk’s UniqueId. Deleting a disk and creating another with the same name changes UniqueId. Microsoft’s PowerShell example uses both source values when selecting the incremental snapshots associated with one disk. Microsoft Learn.

\n

Applicability

\n

Use this check when a recovery inventory or cleanup process groups snapshots by disk name or resource path. Identify whether the source disk was replaced, recreated, or removed. Keep snapshots of an earlier disk instance visible as a separate population rather than assuming that an identical name means continuous identity.

\n

DSE recommendation

\n

Match both the source resource ID and source unique ID when assigning snapshots to a particular disk instance. Preserve the original identity pair in the recovery register before retiring a disk. Ask the recovery owner to label each historical population with its intended retention and use. Review automation that selects only a disk name, especially if that selection drives restoration or deletion.

\n

Verification

\n

In a disposable test, compare snapshots taken before and after a same-name disk replacement and inspect their source identity fields. Confirm that the inventory keeps those populations separate while still retaining the historical snapshots intentionally. For a recovery exercise, record the selected snapshot’s identity pair beside the intended source generation. Investigate a missing or mismatched identifier before authorizing a restore or cleanup based on that inventory.

\n

Official references

\n

Microsoft Learn: Create an incremental snapshot for managed disks. Source reviewed September 9, 2026.

", "content_text": "Source facts\nAzure incremental snapshots expose SourceResourceId for the source disk’s resource identity and SourceUniqueId inherited from the disk’s UniqueId. Deleting a disk and creating another with the same name changes UniqueId. Microsoft’s PowerShell example uses both source values when selecting the incremental snapshots associated with one disk. Microsoft Learn.\nApplicability\nUse this check when a recovery inventory or cleanup process groups snapshots by disk name or resource path. Identify whether the source disk was replaced, recreated, or removed. Keep snapshots of an earlier disk instance visible as a separate population rather than assuming that an identical name means continuous identity.\nDSE recommendation\nMatch both the source resource ID and source unique ID when assigning snapshots to a particular disk instance. Preserve the original identity pair in the recovery register before retiring a disk. Ask the recovery owner to label each historical population with its intended retention and use. Review automation that selects only a disk name, especially if that selection drives restoration or deletion.\nVerification\nIn a disposable test, compare snapshots taken before and after a same-name disk replacement and inspect their source identity fields. Confirm that the inventory keeps those populations separate while still retaining the historical snapshots intentionally. For a recovery exercise, record the selected snapshot’s identity pair beside the intended source generation. Investigate a missing or mismatched identifier before authorizing a restore or cleanup based on that inventory.\nOfficial references\nMicrosoft Learn: Create an incremental snapshot for managed disks. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nAzure incremental snapshots expose SourceResourceId for the source disk’s resource identity and SourceUniqueId inherited from the disk’s UniqueId. Deleting a disk and creating another with the same name changes UniqueId. Microsoft’s PowerShell example uses both source values when selecting the incremental snapshots associated with one disk. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/disks-incremental-snapshots).\n\n## Applicability\n\nUse this check when a recovery inventory or cleanup process groups snapshots by disk name or resource path. Identify whether the source disk was replaced, recreated, or removed. Keep snapshots of an earlier disk instance visible as a separate population rather than assuming that an identical name means continuous identity.\n\n## DSE recommendation\n\nMatch both the source resource ID and source unique ID when assigning snapshots to a particular disk instance. Preserve the original identity pair in the recovery register before retiring a disk. Ask the recovery owner to label each historical population with its intended retention and use. Review automation that selects only a disk name, especially if that selection drives restoration or deletion.\n\n## Verification\n\nIn a disposable test, compare snapshots taken before and after a same-name disk replacement and inspect their source identity fields. Confirm that the inventory keeps those populations separate while still retaining the historical snapshots intentionally. For a recovery exercise, record the selected snapshot’s identity pair beside the intended source generation. Investigate a missing or mismatched identifier before authorizing a restore or cleanup based on that inventory.\n\n## Official references\n\n[Microsoft Learn: Create an incremental snapshot for managed disks](https://learn.microsoft.com/en-us/azure/virtual-machines/disks-incremental-snapshots). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-053-match-incremental-snapshots-to-the-disk-instance-not-just-its-reused-name/", "url": "https://update.dsesecurity.com/updates/dse-20260909-053-match-incremental-snapshots-to-the-disk-instance-not-just-its-reused-name/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-053-match-incremental-snapshots-to-the-disk-instance-not-just-its-reused-name/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Match incremental snapshots to the disk instance, not just its reused name", "item": "https://update.dsesecurity.com/updates/dse-20260909-053-match-incremental-snapshots-to-the-disk-instance-not-just-its-reused-name/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-053-match-incremental-snapshots-to-the-disk-instance-not-just-its-reused-name/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-053-match-incremental-snapshots-to-the-disk-instance-not-just-its-reused-name/", "url": "https://update.dsesecurity.com/updates/dse-20260909-053-match-incremental-snapshots-to-the-disk-instance-not-just-its-reused-name/", "headline": "Match incremental snapshots to the disk instance, not just its reused name", "description": "How can a snapshot inventory distinguish a recreated Azure disk from its predecessor?", "abstract": "How can a snapshot inventory distinguish a recreated Azure disk from its predecessor?", "articleBody": "Source facts\nAzure incremental snapshots expose SourceResourceId for the source disk’s resource identity and SourceUniqueId inherited from the disk’s UniqueId. Deleting a disk and creating another with the same name changes UniqueId. Microsoft’s PowerShell example uses both source values when selecting the incremental snapshots associated with one disk. Microsoft Learn.\nApplicability\nUse this check when a recovery inventory or cleanup process groups snapshots by disk name or resource path. Identify whether the source disk was replaced, recreated, or removed. Keep snapshots of an earlier disk instance visible as a separate population rather than assuming that an identical name means continuous identity.\nDSE recommendation\nMatch both the source resource ID and source unique ID when assigning snapshots to a particular disk instance. Preserve the original identity pair in the recovery register before retiring a disk. Ask the recovery owner to label each historical population with its intended retention and use. Review automation that selects only a disk name, especially if that selection drives restoration or deletion.\nVerification\nIn a disposable test, compare snapshots taken before and after a same-name disk replacement and inspect their source identity fields. Confirm that the inventory keeps those populations separate while still retaining the historical snapshots intentionally. For a recovery exercise, record the selected snapshot’s identity pair beside the intended source generation. Investigate a missing or mismatched identifier before authorizing a restore or cleanup based on that inventory.\nOfficial references\nMicrosoft Learn: Create an incremental snapshot for managed disks. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:31:03+00:00", "dateModified": "2026-09-10T00:35:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-053-match-incremental-snapshots-to-the-disk-instance-not-just-its-reused-name/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-053-match-incremental-snapshots-to-the-disk-instance-not-just-its-reused-name/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Match incremental snapshots to the disk instance, not just its reused name" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 246, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create an incremental snapshot - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/disks-incremental-snapshots" } } ] } }