{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-457-do-not-use-blob-tag-search-as-a-complete-inventory-of-previous-versions/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-457-do-not-use-blob-tag-search-as-a-complete-inventory-of-previous-versions/", "slug": "dse-20260909-457-do-not-use-blob-tag-search-as-a-complete-inventory-of-previous-versions", "url": "https://update.dsesecurity.com/updates/dse-20260909-457-do-not-use-blob-tag-search-as-a-complete-inventory-of-previous-versions/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-457-do-not-use-blob-tag-search-as-a-complete-inventory-of-previous-versions.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-457-do-not-use-blob-tag-search-as-a-complete-inventory-of-previous-versions/" }, "title": "Do not use blob tag search as a complete inventory of previous versions", "summary": "Tags can remain attached to an older blob version without being available to the blob index query engine.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:24:19+00:00", "modified_at": "2026-09-10T02:08:04+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 264, "potentially_affected": "Version-enabled Azure Blob Storage accounts using indexed blob tags.", "dse_recommendation": "Separate current-version tag discovery from the approved inventory of historical versions.", "primary_source": { "name": "Manage and find Azure Blob data with blob index tags | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/storage-manage-find-blobs", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Blob index tags are retained on previous versions, but those historical tags are not sent to the index engine. A tag query therefore cannot retrieve the previous versions. When an earlier version is promoted to current, its tags become current-version tags and are passed to the index for querying.

\n

New and edited tags can take time to appear in the index; the delay depends on the workload and traffic distribution. Microsoft’s hierarchical-namespace tag feature is a separate preview without indexing, so it should not be treated as the indexed search described here. Microsoft Learn.

\n

Applicability

\n

Confirm that the account supports indexed tags and identify whether the requested inventory covers current data, historical versions or both. Do not turn a tag-search result into a statement about a different scope.

\n

DSE recommendation

\n

DSE recommends documenting the discovery method and its version coverage beside any retention, recovery or investigation result. Use an approved version-aware inventory when the question includes historical data. Do not promote a version merely to make it searchable: that would change which version is current and should require its own recovery decision.

\n

Verification

\n

In a test container, create a known version history with distinguishable tags and compare the approved version inventory with current-version search results. Allow for observed indexing delay when validating changes. Record the query, permissions, observation time and version scope. A missing historical match should trigger the appropriate version inspection, not a conclusion that the data never existed or has been fully removed.

\n

Official references

\n

Microsoft Learn: Manage and find Azure Blob data with blob index tags. Source retrieved September 9, 2026.

", "content_text": "Source facts\nBlob index tags are retained on previous versions, but those historical tags are not sent to the index engine. A tag query therefore cannot retrieve the previous versions. When an earlier version is promoted to current, its tags become current-version tags and are passed to the index for querying.\nNew and edited tags can take time to appear in the index; the delay depends on the workload and traffic distribution. Microsoft’s hierarchical-namespace tag feature is a separate preview without indexing, so it should not be treated as the indexed search described here. Microsoft Learn.\nApplicability\nConfirm that the account supports indexed tags and identify whether the requested inventory covers current data, historical versions or both. Do not turn a tag-search result into a statement about a different scope.\nDSE recommendation\nDSE recommends documenting the discovery method and its version coverage beside any retention, recovery or investigation result. Use an approved version-aware inventory when the question includes historical data. Do not promote a version merely to make it searchable: that would change which version is current and should require its own recovery decision.\nVerification\nIn a test container, create a known version history with distinguishable tags and compare the approved version inventory with current-version search results. Allow for observed indexing delay when validating changes. Record the query, permissions, observation time and version scope. A missing historical match should trigger the appropriate version inspection, not a conclusion that the data never existed or has been fully removed.\nOfficial references\nMicrosoft Learn: Manage and find Azure Blob data with blob index tags. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nBlob index tags are retained on previous versions, but those historical tags are not sent to the index engine. A tag query therefore cannot retrieve the previous versions. When an earlier version is promoted to current, its tags become current-version tags and are passed to the index for querying.\n\nNew and edited tags can take time to appear in the index; the delay depends on the workload and traffic distribution. Microsoft’s hierarchical-namespace tag feature is a separate preview without indexing, so it should not be treated as the indexed search described here. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-manage-find-blobs).\n\n## Applicability\n\nConfirm that the account supports indexed tags and identify whether the requested inventory covers current data, historical versions or both. Do not turn a tag-search result into a statement about a different scope.\n\n## DSE recommendation\n\nDSE recommends documenting the discovery method and its version coverage beside any retention, recovery or investigation result. Use an approved version-aware inventory when the question includes historical data. Do not promote a version merely to make it searchable: that would change which version is current and should require its own recovery decision.\n\n## Verification\n\nIn a test container, create a known version history with distinguishable tags and compare the approved version inventory with current-version search results. Allow for observed indexing delay when validating changes. Record the query, permissions, observation time and version scope. A missing historical match should trigger the appropriate version inspection, not a conclusion that the data never existed or has been fully removed.\n\n## Official references\n\n[Microsoft Learn: Manage and find Azure Blob data with blob index tags](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-manage-find-blobs). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-457-do-not-use-blob-tag-search-as-a-complete-inventory-of-previous-versions/", "url": "https://update.dsesecurity.com/updates/dse-20260909-457-do-not-use-blob-tag-search-as-a-complete-inventory-of-previous-versions/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-457-do-not-use-blob-tag-search-as-a-complete-inventory-of-previous-versions/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Do not use blob tag search as a complete inventory of previous versions", "item": "https://update.dsesecurity.com/updates/dse-20260909-457-do-not-use-blob-tag-search-as-a-complete-inventory-of-previous-versions/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-457-do-not-use-blob-tag-search-as-a-complete-inventory-of-previous-versions/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-457-do-not-use-blob-tag-search-as-a-complete-inventory-of-previous-versions/", "url": "https://update.dsesecurity.com/updates/dse-20260909-457-do-not-use-blob-tag-search-as-a-complete-inventory-of-previous-versions/", "headline": "Do not use blob tag search as a complete inventory of previous versions", "description": "Tags can remain attached to an older blob version without being available to the blob index query engine.", "abstract": "Tags can remain attached to an older blob version without being available to the blob index query engine.", "articleBody": "Source facts\nBlob index tags are retained on previous versions, but those historical tags are not sent to the index engine. A tag query therefore cannot retrieve the previous versions. When an earlier version is promoted to current, its tags become current-version tags and are passed to the index for querying.\nNew and edited tags can take time to appear in the index; the delay depends on the workload and traffic distribution. Microsoft’s hierarchical-namespace tag feature is a separate preview without indexing, so it should not be treated as the indexed search described here. Microsoft Learn.\nApplicability\nConfirm that the account supports indexed tags and identify whether the requested inventory covers current data, historical versions or both. Do not turn a tag-search result into a statement about a different scope.\nDSE recommendation\nDSE recommends documenting the discovery method and its version coverage beside any retention, recovery or investigation result. Use an approved version-aware inventory when the question includes historical data. Do not promote a version merely to make it searchable: that would change which version is current and should require its own recovery decision.\nVerification\nIn a test container, create a known version history with distinguishable tags and compare the approved version inventory with current-version search results. Allow for observed indexing delay when validating changes. Record the query, permissions, observation time and version scope. A missing historical match should trigger the appropriate version inspection, not a conclusion that the data never existed or has been fully removed.\nOfficial references\nMicrosoft Learn: Manage and find Azure Blob data with blob index tags. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:24:19+00:00", "dateModified": "2026-09-10T02:08:04+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-457-do-not-use-blob-tag-search-as-a-complete-inventory-of-previous-versions/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-457-do-not-use-blob-tag-search-as-a-complete-inventory-of-previous-versions/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not use blob tag search as a complete inventory of previous versions" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 264, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Manage and find Azure Blob data with blob index tags | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/storage-manage-find-blobs" } } ] } }