{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-217-do-not-use-azure-firewall-connection-logs-as-azure-files-operation-records/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-217-do-not-use-azure-firewall-connection-logs-as-azure-files-operation-records/", "slug": "dse-20260909-217-do-not-use-azure-firewall-connection-logs-as-azure-files-operation-records", "url": "https://update.dsesecurity.com/updates/dse-20260909-217-do-not-use-azure-firewall-connection-logs-as-azure-files-operation-records/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-217-do-not-use-azure-firewall-connection-logs-as-azure-files-operation-records.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-217-do-not-use-azure-firewall-connection-logs-as-azure-files-operation-records/" }, "title": "Do not use Azure Firewall connection logs as Azure Files operation records", "summary": "Recognize the persistent-connection logging boundary when inspecting private-endpoint file access through a secured virtual hub.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:19+00:00", "modified_at": "2026-09-10T01:20:46+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 243, "potentially_affected": "Azure Files private-endpoint traffic inspected by Azure Firewall in a secured Virtual WAN hub.", "dse_recommendation": "Separate proof of the initial inspected connection from evidence of individual file operations.", "primary_source": { "name": "Secure traffic destined to private endpoints in Azure Virtual WAN | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/firewall-manager/private-link-inspection-secure-virtual-hub", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

In its secured-virtual-hub guidance, Microsoft says Azure Firewall network-rule entries for Azure Files private endpoints are generated when the client first connects or mounts the share. Individual create, read, update and delete operations do not produce corresponding firewall entries because they use that persistent TCP connection.

\n

The same guidance says network-rule logs omit FQDN information and should be filtered using the address and port. The article’s architecture scope is a secured virtual hub, not a firewall in a conventional hub VNet. Microsoft Learn.

\n

Applicability

\n

Identify the client, share endpoint, firewall path, and connection interval under investigation. Keep the question of whether the initial connection was inspected separate from the question of which files were subsequently accessed.

\n

DSE recommendation

\n

DSE recommends labeling firewall evidence as connection-level evidence in the investigation record. Ask the file-service owner to identify and validate an appropriate additional evidence source for any operation-level requirement. Do not interpret the absence of one firewall entry per file action as proof of either bypass or inactivity.

\n

Verification

\n

In an approved test, establish a fresh share connection and perform a small set of harmless, recorded file operations. Correlate the initial connection with address-and-port firewall evidence. Compare the individual operations with the separately selected file evidence, documenting any gaps. Preserve the tested architecture and time boundaries so conclusions are not generalized to an untested traffic path.

\n

Official references

\n

Microsoft Learn: Secure traffic destined to private endpoints in Azure Virtual WAN. Source retrieved September 9, 2026.

", "content_text": "Source facts\nIn its secured-virtual-hub guidance, Microsoft says Azure Firewall network-rule entries for Azure Files private endpoints are generated when the client first connects or mounts the share. Individual create, read, update and delete operations do not produce corresponding firewall entries because they use that persistent TCP connection.\nThe same guidance says network-rule logs omit FQDN information and should be filtered using the address and port. The article’s architecture scope is a secured virtual hub, not a firewall in a conventional hub VNet. Microsoft Learn.\nApplicability\nIdentify the client, share endpoint, firewall path, and connection interval under investigation. Keep the question of whether the initial connection was inspected separate from the question of which files were subsequently accessed.\nDSE recommendation\nDSE recommends labeling firewall evidence as connection-level evidence in the investigation record. Ask the file-service owner to identify and validate an appropriate additional evidence source for any operation-level requirement. Do not interpret the absence of one firewall entry per file action as proof of either bypass or inactivity.\nVerification\nIn an approved test, establish a fresh share connection and perform a small set of harmless, recorded file operations. Correlate the initial connection with address-and-port firewall evidence. Compare the individual operations with the separately selected file evidence, documenting any gaps. Preserve the tested architecture and time boundaries so conclusions are not generalized to an untested traffic path.\nOfficial references\nMicrosoft Learn: Secure traffic destined to private endpoints in Azure Virtual WAN. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nIn its secured-virtual-hub guidance, Microsoft says Azure Firewall network-rule entries for Azure Files private endpoints are generated when the client first connects or mounts the share. Individual create, read, update and delete operations do not produce corresponding firewall entries because they use that persistent TCP connection.\n\nThe same guidance says network-rule logs omit FQDN information and should be filtered using the address and port. The article’s architecture scope is a secured virtual hub, not a firewall in a conventional hub VNet. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/firewall-manager/private-link-inspection-secure-virtual-hub).\n\n## Applicability\n\nIdentify the client, share endpoint, firewall path, and connection interval under investigation. Keep the question of whether the initial connection was inspected separate from the question of which files were subsequently accessed.\n\n## DSE recommendation\n\nDSE recommends labeling firewall evidence as connection-level evidence in the investigation record. Ask the file-service owner to identify and validate an appropriate additional evidence source for any operation-level requirement. Do not interpret the absence of one firewall entry per file action as proof of either bypass or inactivity.\n\n## Verification\n\nIn an approved test, establish a fresh share connection and perform a small set of harmless, recorded file operations. Correlate the initial connection with address-and-port firewall evidence. Compare the individual operations with the separately selected file evidence, documenting any gaps. Preserve the tested architecture and time boundaries so conclusions are not generalized to an untested traffic path.\n\n## Official references\n\n[Microsoft Learn: Secure traffic destined to private endpoints in Azure Virtual WAN](https://learn.microsoft.com/en-us/azure/firewall-manager/private-link-inspection-secure-virtual-hub). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-217-do-not-use-azure-firewall-connection-logs-as-azure-files-operation-records/", "url": "https://update.dsesecurity.com/updates/dse-20260909-217-do-not-use-azure-firewall-connection-logs-as-azure-files-operation-records/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-217-do-not-use-azure-firewall-connection-logs-as-azure-files-operation-records/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Do not use Azure Firewall connection logs as Azure Files operation records", "item": "https://update.dsesecurity.com/updates/dse-20260909-217-do-not-use-azure-firewall-connection-logs-as-azure-files-operation-records/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-217-do-not-use-azure-firewall-connection-logs-as-azure-files-operation-records/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-217-do-not-use-azure-firewall-connection-logs-as-azure-files-operation-records/", "url": "https://update.dsesecurity.com/updates/dse-20260909-217-do-not-use-azure-firewall-connection-logs-as-azure-files-operation-records/", "headline": "Do not use Azure Firewall connection logs as Azure Files operation records", "description": "Recognize the persistent-connection logging boundary when inspecting private-endpoint file access through a secured virtual hub.", "abstract": "Recognize the persistent-connection logging boundary when inspecting private-endpoint file access through a secured virtual hub.", "articleBody": "Source facts\nIn its secured-virtual-hub guidance, Microsoft says Azure Firewall network-rule entries for Azure Files private endpoints are generated when the client first connects or mounts the share. Individual create, read, update and delete operations do not produce corresponding firewall entries because they use that persistent TCP connection.\nThe same guidance says network-rule logs omit FQDN information and should be filtered using the address and port. The article’s architecture scope is a secured virtual hub, not a firewall in a conventional hub VNet. Microsoft Learn.\nApplicability\nIdentify the client, share endpoint, firewall path, and connection interval under investigation. Keep the question of whether the initial connection was inspected separate from the question of which files were subsequently accessed.\nDSE recommendation\nDSE recommends labeling firewall evidence as connection-level evidence in the investigation record. Ask the file-service owner to identify and validate an appropriate additional evidence source for any operation-level requirement. Do not interpret the absence of one firewall entry per file action as proof of either bypass or inactivity.\nVerification\nIn an approved test, establish a fresh share connection and perform a small set of harmless, recorded file operations. Correlate the initial connection with address-and-port firewall evidence. Compare the individual operations with the separately selected file evidence, documenting any gaps. Preserve the tested architecture and time boundaries so conclusions are not generalized to an untested traffic path.\nOfficial references\nMicrosoft Learn: Secure traffic destined to private endpoints in Azure Virtual WAN. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:28:19+00:00", "dateModified": "2026-09-10T01:20:46+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-217-do-not-use-azure-firewall-connection-logs-as-azure-files-operation-records/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-217-do-not-use-azure-firewall-connection-logs-as-azure-files-operation-records/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not use Azure Firewall connection logs as Azure Files operation records" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 243, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Secure traffic destined to private endpoints in Azure Virtual WAN | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/firewall-manager/private-link-inspection-secure-virtual-hub" } } ] } }