{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-130-do-not-read-zero-property-changes-as-no-azure-resource-event/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-130-do-not-read-zero-property-changes-as-no-azure-resource-event/", "slug": "dse-20260909-130-do-not-read-zero-property-changes-as-no-azure-resource-event", "url": "https://update.dsesecurity.com/updates/dse-20260909-130-do-not-read-zero-property-changes-as-no-azure-resource-event/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-130-do-not-read-zero-property-changes-as-no-azure-resource-event.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-130-do-not-read-zero-property-changes-as-no-azure-resource-event/" }, "title": "Do not read zero property changes as no Azure resource event", "summary": "Interpret Resource Graph change type alongside the property count, especially for creation and deletion.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:29:46+00:00", "modified_at": "2026-09-10T00:52:38+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 221, "potentially_affected": "Azure Resource Graph change-analysis consumers.", "dse_recommendation": "Preserve change type and target identity instead of filtering change records solely by property count.", "primary_source": { "name": "Get resource changes - Azure Resource Graph | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/resource-graph/changes/get-resource-changes", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Resource Graph change records can report zero in changesCount for both creation and deletion. Microsoft explains that creation would otherwise generate excessive property noise, while deletion leaves no remaining resource properties. Deleted-resource snapshots are not currently supported.

\n

Newly introduced properties are not necessarily shown as changes either; the source gives new API-version properties and newly added empty tag keys as examples. Microsoft Learn.

\n

Applicability

\n

Review queries, dashboards, and exports that use resourcechanges or related change tables. Identify any filter that discards a record merely because it lacks a positive property-change count, and document what events the consumer is intended to retain.

\n

DSE recommendation

\n

DSE recommends treating event type, target resource identifier, time, and property details as separate fields. Make creation and deletion visible through their event type even when there is no property diff. State the snapshot and property-coverage limits in the consumer’s documentation so an operator does not mistake this feed for a complete recovery image.

\n

Verification

\n

In a disposable scope, create, update, and delete an approved test resource. Compare the resulting records with the known operations and check that zero-count events survive the consumer’s filters. Verify the report distinguishes absent property detail from an absent event, and retain the query and observed payloads as the test fixture.

\n

Official references

\n

Microsoft Learn: Get resource changes. Source retrieved September 9, 2026.

", "content_text": "Source facts\nResource Graph change records can report zero in changesCount for both creation and deletion. Microsoft explains that creation would otherwise generate excessive property noise, while deletion leaves no remaining resource properties. Deleted-resource snapshots are not currently supported.\nNewly introduced properties are not necessarily shown as changes either; the source gives new API-version properties and newly added empty tag keys as examples. Microsoft Learn.\nApplicability\nReview queries, dashboards, and exports that use resourcechanges or related change tables. Identify any filter that discards a record merely because it lacks a positive property-change count, and document what events the consumer is intended to retain.\nDSE recommendation\nDSE recommends treating event type, target resource identifier, time, and property details as separate fields. Make creation and deletion visible through their event type even when there is no property diff. State the snapshot and property-coverage limits in the consumer’s documentation so an operator does not mistake this feed for a complete recovery image.\nVerification\nIn a disposable scope, create, update, and delete an approved test resource. Compare the resulting records with the known operations and check that zero-count events survive the consumer’s filters. Verify the report distinguishes absent property detail from an absent event, and retain the query and observed payloads as the test fixture.\nOfficial references\nMicrosoft Learn: Get resource changes. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nResource Graph change records can report zero in changesCount for both creation and deletion. Microsoft explains that creation would otherwise generate excessive property noise, while deletion leaves no remaining resource properties. Deleted-resource snapshots are not currently supported.\n\nNewly introduced properties are not necessarily shown as changes either; the source gives new API-version properties and newly added empty tag keys as examples. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/resource-graph/changes/get-resource-changes).\n\n## Applicability\n\nReview queries, dashboards, and exports that use resourcechanges or related change tables. Identify any filter that discards a record merely because it lacks a positive property-change count, and document what events the consumer is intended to retain.\n\n## DSE recommendation\n\nDSE recommends treating event type, target resource identifier, time, and property details as separate fields. Make creation and deletion visible through their event type even when there is no property diff. State the snapshot and property-coverage limits in the consumer’s documentation so an operator does not mistake this feed for a complete recovery image.\n\n## Verification\n\nIn a disposable scope, create, update, and delete an approved test resource. Compare the resulting records with the known operations and check that zero-count events survive the consumer’s filters. Verify the report distinguishes absent property detail from an absent event, and retain the query and observed payloads as the test fixture.\n\n## Official references\n\n[Microsoft Learn: Get resource changes](https://learn.microsoft.com/en-us/azure/governance/resource-graph/changes/get-resource-changes). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-130-do-not-read-zero-property-changes-as-no-azure-resource-event/", "url": "https://update.dsesecurity.com/updates/dse-20260909-130-do-not-read-zero-property-changes-as-no-azure-resource-event/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-130-do-not-read-zero-property-changes-as-no-azure-resource-event/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Do not read zero property changes as no Azure resource event", "item": "https://update.dsesecurity.com/updates/dse-20260909-130-do-not-read-zero-property-changes-as-no-azure-resource-event/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-130-do-not-read-zero-property-changes-as-no-azure-resource-event/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-130-do-not-read-zero-property-changes-as-no-azure-resource-event/", "url": "https://update.dsesecurity.com/updates/dse-20260909-130-do-not-read-zero-property-changes-as-no-azure-resource-event/", "headline": "Do not read zero property changes as no Azure resource event", "description": "Interpret Resource Graph change type alongside the property count, especially for creation and deletion.", "abstract": "Interpret Resource Graph change type alongside the property count, especially for creation and deletion.", "articleBody": "Source facts\nResource Graph change records can report zero in changesCount for both creation and deletion. Microsoft explains that creation would otherwise generate excessive property noise, while deletion leaves no remaining resource properties. Deleted-resource snapshots are not currently supported.\nNewly introduced properties are not necessarily shown as changes either; the source gives new API-version properties and newly added empty tag keys as examples. Microsoft Learn.\nApplicability\nReview queries, dashboards, and exports that use resourcechanges or related change tables. Identify any filter that discards a record merely because it lacks a positive property-change count, and document what events the consumer is intended to retain.\nDSE recommendation\nDSE recommends treating event type, target resource identifier, time, and property details as separate fields. Make creation and deletion visible through their event type even when there is no property diff. State the snapshot and property-coverage limits in the consumer’s documentation so an operator does not mistake this feed for a complete recovery image.\nVerification\nIn a disposable scope, create, update, and delete an approved test resource. Compare the resulting records with the known operations and check that zero-count events survive the consumer’s filters. Verify the report distinguishes absent property detail from an absent event, and retain the query and observed payloads as the test fixture.\nOfficial references\nMicrosoft Learn: Get resource changes. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:29:46+00:00", "dateModified": "2026-09-10T00:52:38+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-130-do-not-read-zero-property-changes-as-no-azure-resource-event/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-130-do-not-read-zero-property-changes-as-no-azure-resource-event/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not read zero property changes as no Azure resource event" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 221, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Get resource changes - Azure Resource Graph | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/resource-graph/changes/get-resource-changes" } } ] } }