{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-355-verify-resource-graph-candidates-against-the-provider-before-irreversible-actions/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-355-verify-resource-graph-candidates-against-the-provider-before-irreversible-actions/", "slug": "dse-20260909-355-verify-resource-graph-candidates-against-the-provider-before-irreversible-actions", "url": "https://update.dsesecurity.com/updates/dse-20260909-355-verify-resource-graph-candidates-against-the-provider-before-irreversible-actions/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-355-verify-resource-graph-candidates-against-the-provider-before-irreversible-actions.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-355-verify-resource-graph-candidates-against-the-provider-before-irreversible-actions/" }, "title": "Verify Resource Graph candidates against the provider before irreversible actions", "summary": "An asynchronously indexed resource list is useful for discovery, but stale state must not directly authorize destructive automation.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:26:01+00:00", "modified_at": "2026-09-10T02:01:55+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 239, "potentially_affected": "Azure automation that selects resources through Resource Graph and then performs customer-impacting actions.", "dse_recommendation": "Use Resource Graph for selection and the owning resource provider for the final state check.", "primary_source": { "name": "Choose the right query strategy for Azure Resource Graph - Azure Resource Graph | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/resource-graph/choose-query-strategy", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure Resource Graph indexes control-plane data asynchronously and can lag behind the owning resource provider. Microsoft recommends a hybrid approach for critical decisions: discover at scale through Resource Graph, then verify current state with the provider immediately before irreversible action.

\n

A query immediately after creation can report not found even though the resource exists. The guidance advises provider fallback for this case and warns against verifying through the provider on every ordinary poll, which defeats the scaling benefit and can trigger throttling. Microsoft Learn.

\n

Applicability

\n

Identify the selection query, intended action and provider operation that establishes the necessary current state. Distinguish a stale negative result from confirmed absence.

\n

DSE recommendation

\n

DSE recommends separating candidate discovery from action authorization in the workflow. Immediately before an irreversible step, recheck the exact resource and decision-relevant properties through the provider. Stop if the state differs from the approved conditions or cannot be established. Do not reinterpret a failed freshness check as permission to delete, recreate or restart the resource.

\n

Verification

\n

In a nonproduction test, introduce an authorized resource-state change between selection and execution. Confirm that the final check detects the difference and stops the proposed action. Test the recently created-resource case separately. Retain both observations and their times so the automation’s decision can be explained without presenting the indexed result as a guaranteed current snapshot.

\n

Official references

\n

Microsoft Learn: Choose the right query strategy for Azure Resource Graph. Source retrieved September 9, 2026.

", "content_text": "Source facts\nAzure Resource Graph indexes control-plane data asynchronously and can lag behind the owning resource provider. Microsoft recommends a hybrid approach for critical decisions: discover at scale through Resource Graph, then verify current state with the provider immediately before irreversible action.\nA query immediately after creation can report not found even though the resource exists. The guidance advises provider fallback for this case and warns against verifying through the provider on every ordinary poll, which defeats the scaling benefit and can trigger throttling. Microsoft Learn.\nApplicability\nIdentify the selection query, intended action and provider operation that establishes the necessary current state. Distinguish a stale negative result from confirmed absence.\nDSE recommendation\nDSE recommends separating candidate discovery from action authorization in the workflow. Immediately before an irreversible step, recheck the exact resource and decision-relevant properties through the provider. Stop if the state differs from the approved conditions or cannot be established. Do not reinterpret a failed freshness check as permission to delete, recreate or restart the resource.\nVerification\nIn a nonproduction test, introduce an authorized resource-state change between selection and execution. Confirm that the final check detects the difference and stops the proposed action. Test the recently created-resource case separately. Retain both observations and their times so the automation’s decision can be explained without presenting the indexed result as a guaranteed current snapshot.\nOfficial references\nMicrosoft Learn: Choose the right query strategy for Azure Resource Graph. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nAzure Resource Graph indexes control-plane data asynchronously and can lag behind the owning resource provider. Microsoft recommends a hybrid approach for critical decisions: discover at scale through Resource Graph, then verify current state with the provider immediately before irreversible action.\n\nA query immediately after creation can report not found even though the resource exists. The guidance advises provider fallback for this case and warns against verifying through the provider on every ordinary poll, which defeats the scaling benefit and can trigger throttling. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/resource-graph/choose-query-strategy).\n\n## Applicability\n\nIdentify the selection query, intended action and provider operation that establishes the necessary current state. Distinguish a stale negative result from confirmed absence.\n\n## DSE recommendation\n\nDSE recommends separating candidate discovery from action authorization in the workflow. Immediately before an irreversible step, recheck the exact resource and decision-relevant properties through the provider. Stop if the state differs from the approved conditions or cannot be established. Do not reinterpret a failed freshness check as permission to delete, recreate or restart the resource.\n\n## Verification\n\nIn a nonproduction test, introduce an authorized resource-state change between selection and execution. Confirm that the final check detects the difference and stops the proposed action. Test the recently created-resource case separately. Retain both observations and their times so the automation’s decision can be explained without presenting the indexed result as a guaranteed current snapshot.\n\n## Official references\n\n[Microsoft Learn: Choose the right query strategy for Azure Resource Graph](https://learn.microsoft.com/en-us/azure/governance/resource-graph/choose-query-strategy). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-355-verify-resource-graph-candidates-against-the-provider-before-irreversible-actions/", "url": "https://update.dsesecurity.com/updates/dse-20260909-355-verify-resource-graph-candidates-against-the-provider-before-irreversible-actions/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-355-verify-resource-graph-candidates-against-the-provider-before-irreversible-actions/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Verify Resource Graph candidates against the provider before irreversible actions", "item": "https://update.dsesecurity.com/updates/dse-20260909-355-verify-resource-graph-candidates-against-the-provider-before-irreversible-actions/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-355-verify-resource-graph-candidates-against-the-provider-before-irreversible-actions/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-355-verify-resource-graph-candidates-against-the-provider-before-irreversible-actions/", "url": "https://update.dsesecurity.com/updates/dse-20260909-355-verify-resource-graph-candidates-against-the-provider-before-irreversible-actions/", "headline": "Verify Resource Graph candidates against the provider before irreversible actions", "description": "An asynchronously indexed resource list is useful for discovery, but stale state must not directly authorize destructive automation.", "abstract": "An asynchronously indexed resource list is useful for discovery, but stale state must not directly authorize destructive automation.", "articleBody": "Source facts\nAzure Resource Graph indexes control-plane data asynchronously and can lag behind the owning resource provider. Microsoft recommends a hybrid approach for critical decisions: discover at scale through Resource Graph, then verify current state with the provider immediately before irreversible action.\nA query immediately after creation can report not found even though the resource exists. The guidance advises provider fallback for this case and warns against verifying through the provider on every ordinary poll, which defeats the scaling benefit and can trigger throttling. Microsoft Learn.\nApplicability\nIdentify the selection query, intended action and provider operation that establishes the necessary current state. Distinguish a stale negative result from confirmed absence.\nDSE recommendation\nDSE recommends separating candidate discovery from action authorization in the workflow. Immediately before an irreversible step, recheck the exact resource and decision-relevant properties through the provider. Stop if the state differs from the approved conditions or cannot be established. Do not reinterpret a failed freshness check as permission to delete, recreate or restart the resource.\nVerification\nIn a nonproduction test, introduce an authorized resource-state change between selection and execution. Confirm that the final check detects the difference and stops the proposed action. Test the recently created-resource case separately. Retain both observations and their times so the automation’s decision can be explained without presenting the indexed result as a guaranteed current snapshot.\nOfficial references\nMicrosoft Learn: Choose the right query strategy for Azure Resource Graph. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:26:01+00:00", "dateModified": "2026-09-10T02:01:55+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-355-verify-resource-graph-candidates-against-the-provider-before-irreversible-actions/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-355-verify-resource-graph-candidates-against-the-provider-before-irreversible-actions/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Verify Resource Graph candidates against the provider before irreversible actions" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 239, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Choose the right query strategy for Azure Resource Graph - Azure Resource Graph | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/resource-graph/choose-query-strategy" } } ] } }