{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-328-do-not-treat-blob-change-feed-as-a-complete-access-audit/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-328-do-not-treat-blob-change-feed-as-a-complete-access-audit/", "slug": "dse-20260909-328-do-not-treat-blob-change-feed-as-a-complete-access-audit", "url": "https://update.dsesecurity.com/updates/dse-20260909-328-do-not-treat-blob-change-feed-as-a-complete-access-audit/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-328-do-not-treat-blob-change-feed-as-a-complete-access-audit.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-328-do-not-treat-blob-change-feed-as-a-complete-access-audit/" }, "title": "Do not treat Blob change feed as a complete access audit", "summary": "Change feed records successful mutations in per-blob order; read attempts and failed requests need a different evidence source.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:26:28+00:00", "modified_at": "2026-09-10T01:40:03+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 241, "potentially_affected": "Supported Azure Blob Storage accounts without hierarchical namespace that use change-feed consumers.", "dse_recommendation": "Define the consumer's required events and ordering boundary before choosing change feed as its evidence source.", "primary_source": { "name": "Change feed in Blob Storage - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-change-feed", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Blob change feed records successful mutations, including creation, modification and deletion. Its ordering guarantee is per blob; read operations and failed requests are not part of that mutation log.

\n

Microsoft supports change feed for standard general-purpose v2, premium block blob and Blob storage accounts. Accounts with hierarchical namespace are not currently supported.

\n

Deletion coverage also has a limit: BlobDeleted records concern the base blob, not removal of an individual version or snapshot. Microsoft Learn.

\n

Applicability

\n

Identify the account type, namespace setting and exact consumer requirement. Separate a mutation-processing application from an investigation that needs access attempts or cross-object chronology.

\n

DSE recommendation

\n

DSE recommends writing an event-coverage contract before relying on this feed. State which successful changes the application needs, how it identifies each blob and what ordering assumptions it makes. Select separately supported telemetry for reads or failures instead of labeling their absence as proof that they never occurred. Avoid turning a per-object guarantee into a global transaction sequence.

\n

Verification

\n

In a controlled account, compare authorized successful changes, reads and failed requests with the expected evidence sources. Distinguish a base-blob deletion from version or snapshot removal in the test inventory. Review two independently changed blobs without assuming their combined presentation proves a total order. Retain account settings and consumer interpretation with the results. Treat missing required event classes as a design gap, not an empty audit finding.

\n

Official references

\n

Microsoft Learn: Change feed in Blob Storage. Source retrieved September 9, 2026.

", "content_text": "Source facts\nBlob change feed records successful mutations, including creation, modification and deletion. Its ordering guarantee is per blob; read operations and failed requests are not part of that mutation log.\nMicrosoft supports change feed for standard general-purpose v2, premium block blob and Blob storage accounts. Accounts with hierarchical namespace are not currently supported.\nDeletion coverage also has a limit: BlobDeleted records concern the base blob, not removal of an individual version or snapshot. Microsoft Learn.\nApplicability\nIdentify the account type, namespace setting and exact consumer requirement. Separate a mutation-processing application from an investigation that needs access attempts or cross-object chronology.\nDSE recommendation\nDSE recommends writing an event-coverage contract before relying on this feed. State which successful changes the application needs, how it identifies each blob and what ordering assumptions it makes. Select separately supported telemetry for reads or failures instead of labeling their absence as proof that they never occurred. Avoid turning a per-object guarantee into a global transaction sequence.\nVerification\nIn a controlled account, compare authorized successful changes, reads and failed requests with the expected evidence sources. Distinguish a base-blob deletion from version or snapshot removal in the test inventory. Review two independently changed blobs without assuming their combined presentation proves a total order. Retain account settings and consumer interpretation with the results. Treat missing required event classes as a design gap, not an empty audit finding.\nOfficial references\nMicrosoft Learn: Change feed in Blob Storage. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nBlob change feed records successful mutations, including creation, modification and deletion. Its ordering guarantee is per blob; read operations and failed requests are not part of that mutation log.\n\nMicrosoft supports change feed for standard general-purpose v2, premium block blob and Blob storage accounts. Accounts with hierarchical namespace are not currently supported.\n\nDeletion coverage also has a limit: BlobDeleted records concern the base blob, not removal of an individual version or snapshot. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-change-feed).\n\n## Applicability\n\nIdentify the account type, namespace setting and exact consumer requirement. Separate a mutation-processing application from an investigation that needs access attempts or cross-object chronology.\n\n## DSE recommendation\n\nDSE recommends writing an event-coverage contract before relying on this feed. State which successful changes the application needs, how it identifies each blob and what ordering assumptions it makes. Select separately supported telemetry for reads or failures instead of labeling their absence as proof that they never occurred. Avoid turning a per-object guarantee into a global transaction sequence.\n\n## Verification\n\nIn a controlled account, compare authorized successful changes, reads and failed requests with the expected evidence sources. Distinguish a base-blob deletion from version or snapshot removal in the test inventory. Review two independently changed blobs without assuming their combined presentation proves a total order. Retain account settings and consumer interpretation with the results. Treat missing required event classes as a design gap, not an empty audit finding.\n\n## Official references\n\n[Microsoft Learn: Change feed in Blob Storage](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-change-feed). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-328-do-not-treat-blob-change-feed-as-a-complete-access-audit/", "url": "https://update.dsesecurity.com/updates/dse-20260909-328-do-not-treat-blob-change-feed-as-a-complete-access-audit/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-328-do-not-treat-blob-change-feed-as-a-complete-access-audit/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Do not treat Blob change feed as a complete access audit", "item": "https://update.dsesecurity.com/updates/dse-20260909-328-do-not-treat-blob-change-feed-as-a-complete-access-audit/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-328-do-not-treat-blob-change-feed-as-a-complete-access-audit/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-328-do-not-treat-blob-change-feed-as-a-complete-access-audit/", "url": "https://update.dsesecurity.com/updates/dse-20260909-328-do-not-treat-blob-change-feed-as-a-complete-access-audit/", "headline": "Do not treat Blob change feed as a complete access audit", "description": "Change feed records successful mutations in per-blob order; read attempts and failed requests need a different evidence source.", "abstract": "Change feed records successful mutations in per-blob order; read attempts and failed requests need a different evidence source.", "articleBody": "Source facts\nBlob change feed records successful mutations, including creation, modification and deletion. Its ordering guarantee is per blob; read operations and failed requests are not part of that mutation log.\nMicrosoft supports change feed for standard general-purpose v2, premium block blob and Blob storage accounts. Accounts with hierarchical namespace are not currently supported.\nDeletion coverage also has a limit: BlobDeleted records concern the base blob, not removal of an individual version or snapshot. Microsoft Learn.\nApplicability\nIdentify the account type, namespace setting and exact consumer requirement. Separate a mutation-processing application from an investigation that needs access attempts or cross-object chronology.\nDSE recommendation\nDSE recommends writing an event-coverage contract before relying on this feed. State which successful changes the application needs, how it identifies each blob and what ordering assumptions it makes. Select separately supported telemetry for reads or failures instead of labeling their absence as proof that they never occurred. Avoid turning a per-object guarantee into a global transaction sequence.\nVerification\nIn a controlled account, compare authorized successful changes, reads and failed requests with the expected evidence sources. Distinguish a base-blob deletion from version or snapshot removal in the test inventory. Review two independently changed blobs without assuming their combined presentation proves a total order. Retain account settings and consumer interpretation with the results. Treat missing required event classes as a design gap, not an empty audit finding.\nOfficial references\nMicrosoft Learn: Change feed in Blob Storage. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:26:28+00:00", "dateModified": "2026-09-10T01:40:03+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-328-do-not-treat-blob-change-feed-as-a-complete-access-audit/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-328-do-not-treat-blob-change-feed-as-a-complete-access-audit/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not treat Blob change feed as a complete access audit" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 241, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Change feed in Blob Storage - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-change-feed" } } ] } }