{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-180-use-blob-relative-values-in-azure-storage-path-conditions/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-180-use-blob-relative-values-in-azure-storage-path-conditions/", "slug": "dse-20260909-180-use-blob-relative-values-in-azure-storage-path-conditions", "url": "https://update.dsesecurity.com/updates/dse-20260909-180-use-blob-relative-values-in-azure-storage-path-conditions/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-180-use-blob-relative-values-in-azure-storage-path-conditions.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-180-use-blob-relative-values-in-azure-storage-path-conditions/" }, "title": "Use blob-relative values in Azure Storage path conditions", "summary": "Check container names, leading slashes, and URL encoding before diagnosing an ABAC path or prefix mismatch.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:56+00:00", "modified_at": "2026-09-10T00:55:36+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 230, "potentially_affected": "Azure Blob Storage role-assignment conditions using path or prefix attributes.", "dse_recommendation": "Compare condition values with the blob-relative path and test intended and excluded objects before widening access.", "primary_source": { "name": "Actions and attributes for Azure role assignment conditions for Azure Blob Storage - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/storage-auth-abac-attributes", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For the Blob path attribute, Microsoft says condition values omit the container name and any leading slash. The path characters are supplied without URL encoding. The same formatting instructions apply to the Blob prefix attribute.

\n

Available condition attributes also depend on the selected actions. Selecting several actions together can reduce the available attributes because each selected action must support them. Microsoft Learn.

\n

Applicability

\n

Identify the exact role-assignment condition, selected actions, container, and intended blob-relative path. Separate the resource’s full URL from the attribute value used in the condition, and check the current source’s feature status for any additional attributes.

\n

DSE recommendation

\n

DSE recommends a condition test table showing the intended object, the actual value entered, and the expected authorization result. Review formatting errors before changing the role scope or removing a condition. Have the data owner approve any expansion of the allowed prefix; a failed request should not automatically justify broader access.

\n

Verification

\n

Using a controlled identity and harmless blobs, test an intended path and a neighboring excluded path. Include a name containing characters that require URL encoding in a request URL, while keeping the condition value in the documented form. Inspect the selected actions and effective assignments, then preserve the condition and observed results without copying sensitive data.

\n

Official references

\n

Microsoft Learn: Actions and attributes for Azure role assignment conditions for Azure Blob Storage. Source retrieved September 9, 2026.

", "content_text": "Source facts\nFor the Blob path attribute, Microsoft says condition values omit the container name and any leading slash. The path characters are supplied without URL encoding. The same formatting instructions apply to the Blob prefix attribute.\nAvailable condition attributes also depend on the selected actions. Selecting several actions together can reduce the available attributes because each selected action must support them. Microsoft Learn.\nApplicability\nIdentify the exact role-assignment condition, selected actions, container, and intended blob-relative path. Separate the resource’s full URL from the attribute value used in the condition, and check the current source’s feature status for any additional attributes.\nDSE recommendation\nDSE recommends a condition test table showing the intended object, the actual value entered, and the expected authorization result. Review formatting errors before changing the role scope or removing a condition. Have the data owner approve any expansion of the allowed prefix; a failed request should not automatically justify broader access.\nVerification\nUsing a controlled identity and harmless blobs, test an intended path and a neighboring excluded path. Include a name containing characters that require URL encoding in a request URL, while keeping the condition value in the documented form. Inspect the selected actions and effective assignments, then preserve the condition and observed results without copying sensitive data.\nOfficial references\nMicrosoft Learn: Actions and attributes for Azure role assignment conditions for Azure Blob Storage. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nFor the Blob path attribute, Microsoft says condition values omit the container name and any leading slash. The path characters are supplied without URL encoding. The same formatting instructions apply to the Blob prefix attribute.\n\nAvailable condition attributes also depend on the selected actions. Selecting several actions together can reduce the available attributes because each selected action must support them. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-auth-abac-attributes).\n\n## Applicability\n\nIdentify the exact role-assignment condition, selected actions, container, and intended blob-relative path. Separate the resource’s full URL from the attribute value used in the condition, and check the current source’s feature status for any additional attributes.\n\n## DSE recommendation\n\nDSE recommends a condition test table showing the intended object, the actual value entered, and the expected authorization result. Review formatting errors before changing the role scope or removing a condition. Have the data owner approve any expansion of the allowed prefix; a failed request should not automatically justify broader access.\n\n## Verification\n\nUsing a controlled identity and harmless blobs, test an intended path and a neighboring excluded path. Include a name containing characters that require URL encoding in a request URL, while keeping the condition value in the documented form. Inspect the selected actions and effective assignments, then preserve the condition and observed results without copying sensitive data.\n\n## Official references\n\n[Microsoft Learn: Actions and attributes for Azure role assignment conditions for Azure Blob Storage](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-auth-abac-attributes). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-180-use-blob-relative-values-in-azure-storage-path-conditions/", "url": "https://update.dsesecurity.com/updates/dse-20260909-180-use-blob-relative-values-in-azure-storage-path-conditions/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-180-use-blob-relative-values-in-azure-storage-path-conditions/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Use blob-relative values in Azure Storage path conditions", "item": "https://update.dsesecurity.com/updates/dse-20260909-180-use-blob-relative-values-in-azure-storage-path-conditions/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-180-use-blob-relative-values-in-azure-storage-path-conditions/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-180-use-blob-relative-values-in-azure-storage-path-conditions/", "url": "https://update.dsesecurity.com/updates/dse-20260909-180-use-blob-relative-values-in-azure-storage-path-conditions/", "headline": "Use blob-relative values in Azure Storage path conditions", "description": "Check container names, leading slashes, and URL encoding before diagnosing an ABAC path or prefix mismatch.", "abstract": "Check container names, leading slashes, and URL encoding before diagnosing an ABAC path or prefix mismatch.", "articleBody": "Source facts\nFor the Blob path attribute, Microsoft says condition values omit the container name and any leading slash. The path characters are supplied without URL encoding. The same formatting instructions apply to the Blob prefix attribute.\nAvailable condition attributes also depend on the selected actions. Selecting several actions together can reduce the available attributes because each selected action must support them. Microsoft Learn.\nApplicability\nIdentify the exact role-assignment condition, selected actions, container, and intended blob-relative path. Separate the resource’s full URL from the attribute value used in the condition, and check the current source’s feature status for any additional attributes.\nDSE recommendation\nDSE recommends a condition test table showing the intended object, the actual value entered, and the expected authorization result. Review formatting errors before changing the role scope or removing a condition. Have the data owner approve any expansion of the allowed prefix; a failed request should not automatically justify broader access.\nVerification\nUsing a controlled identity and harmless blobs, test an intended path and a neighboring excluded path. Include a name containing characters that require URL encoding in a request URL, while keeping the condition value in the documented form. Inspect the selected actions and effective assignments, then preserve the condition and observed results without copying sensitive data.\nOfficial references\nMicrosoft Learn: Actions and attributes for Azure role assignment conditions for Azure Blob Storage. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:28:56+00:00", "dateModified": "2026-09-10T00:55:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-180-use-blob-relative-values-in-azure-storage-path-conditions/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-180-use-blob-relative-values-in-azure-storage-path-conditions/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Use blob-relative values in Azure Storage path conditions" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 230, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Actions and attributes for Azure role assignment conditions for Azure Blob Storage - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/storage-auth-abac-attributes" } } ] } }