{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-484-do-not-assume-a-base-blob-s-lease-governs-its-snapshot/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-484-do-not-assume-a-base-blob-s-lease-governs-its-snapshot/", "slug": "dse-20260909-484-do-not-assume-a-base-blob-s-lease-governs-its-snapshot", "url": "https://update.dsesecurity.com/updates/dse-20260909-484-do-not-assume-a-base-blob-s-lease-governs-its-snapshot/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-484-do-not-assume-a-base-blob-s-lease-governs-its-snapshot.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-484-do-not-assume-a-base-blob-s-lease-governs-its-snapshot/" }, "title": "Do not assume a base blob's lease governs its snapshot", "summary": "Does a lease associated with an Azure block blob also apply to a snapshot of that blob?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:23:52+00:00", "modified_at": "2026-09-10T02:08:05+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 237, "potentially_affected": "Use this check for an application or operator handling block blobs and snapshots through Azure CLI. Keep lease behavior, object enumeration and the separately required access or retention controls distinct.", "dse_recommendation": "Document snapshot handling independently from the base blob's lease.", "primary_source": { "name": "Manage block blobs with Azure CLI - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/blob-cli", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s block-blob guidance states that leases associated with the base blob do not affect its snapshots. A lease cannot be acquired on a snapshot itself. The CLI’s ordinary blob listing also excludes additional object types by default; the include option can request snapshots, versions and soft-deleted objects. Microsoft Learn.

\n

Applicability

\n

Use this check for an application or operator handling block blobs and snapshots through Azure CLI. Keep lease behavior, object enumeration and the separately required access or retention controls distinct.

\n

DSE recommendation

\n

Document snapshot handling independently from the base blob’s lease. Ask the storage owner which snapshot identities the workflow creates, which callers may operate on them and what approved protection is required. Do not reuse the base object’s lease as the evidence for that decision. Make snapshot enumeration explicit in the operational inventory so a default listing does not hide objects the review intended to include. Choose any additional protection through its own supported design and approval.

\n

Verification

\n

In an approved test container, identify the base blob and its snapshot separately and inspect the applicable lease behavior. Compare a default listing with an explicitly snapshot-inclusive listing. Verify the intended access and retention configuration through the controls that actually provide it, without attempting destructive tests on production copies. Retain any gap between assumed lease coverage and the documented snapshot model as an unresolved workflow requirement.

\n

Official references

\n

Microsoft Learn: Manage block blobs with Azure CLI.

", "content_text": "Source facts\nMicrosoft’s block-blob guidance states that leases associated with the base blob do not affect its snapshots. A lease cannot be acquired on a snapshot itself. The CLI’s ordinary blob listing also excludes additional object types by default; the include option can request snapshots, versions and soft-deleted objects. Microsoft Learn.\nApplicability\nUse this check for an application or operator handling block blobs and snapshots through Azure CLI. Keep lease behavior, object enumeration and the separately required access or retention controls distinct.\nDSE recommendation\nDocument snapshot handling independently from the base blob’s lease. Ask the storage owner which snapshot identities the workflow creates, which callers may operate on them and what approved protection is required. Do not reuse the base object’s lease as the evidence for that decision. Make snapshot enumeration explicit in the operational inventory so a default listing does not hide objects the review intended to include. Choose any additional protection through its own supported design and approval.\nVerification\nIn an approved test container, identify the base blob and its snapshot separately and inspect the applicable lease behavior. Compare a default listing with an explicitly snapshot-inclusive listing. Verify the intended access and retention configuration through the controls that actually provide it, without attempting destructive tests on production copies. Retain any gap between assumed lease coverage and the documented snapshot model as an unresolved workflow requirement.\nOfficial references\nMicrosoft Learn: Manage block blobs with Azure CLI.", "content_markdown": "## Source facts\n\nMicrosoft’s block-blob guidance states that leases associated with the base blob do not affect its snapshots. A lease cannot be acquired on a snapshot itself. The CLI’s ordinary blob listing also excludes additional object types by default; the include option can request snapshots, versions and soft-deleted objects. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/blobs/blob-cli).\n\n## Applicability\n\nUse this check for an application or operator handling block blobs and snapshots through Azure CLI. Keep lease behavior, object enumeration and the separately required access or retention controls distinct.\n\n## DSE recommendation\n\nDocument snapshot handling independently from the base blob’s lease. Ask the storage owner which snapshot identities the workflow creates, which callers may operate on them and what approved protection is required. Do not reuse the base object’s lease as the evidence for that decision. Make snapshot enumeration explicit in the operational inventory so a default listing does not hide objects the review intended to include. Choose any additional protection through its own supported design and approval.\n\n## Verification\n\nIn an approved test container, identify the base blob and its snapshot separately and inspect the applicable lease behavior. Compare a default listing with an explicitly snapshot-inclusive listing. Verify the intended access and retention configuration through the controls that actually provide it, without attempting destructive tests on production copies. Retain any gap between assumed lease coverage and the documented snapshot model as an unresolved workflow requirement.\n\n## Official references\n\n[Microsoft Learn: Manage block blobs with Azure CLI](https://learn.microsoft.com/en-us/azure/storage/blobs/blob-cli)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-484-do-not-assume-a-base-blob-s-lease-governs-its-snapshot/", "url": "https://update.dsesecurity.com/updates/dse-20260909-484-do-not-assume-a-base-blob-s-lease-governs-its-snapshot/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-484-do-not-assume-a-base-blob-s-lease-governs-its-snapshot/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Do not assume a base blob's lease governs its snapshot", "item": "https://update.dsesecurity.com/updates/dse-20260909-484-do-not-assume-a-base-blob-s-lease-governs-its-snapshot/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-484-do-not-assume-a-base-blob-s-lease-governs-its-snapshot/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-484-do-not-assume-a-base-blob-s-lease-governs-its-snapshot/", "url": "https://update.dsesecurity.com/updates/dse-20260909-484-do-not-assume-a-base-blob-s-lease-governs-its-snapshot/", "headline": "Do not assume a base blob's lease governs its snapshot", "description": "Does a lease associated with an Azure block blob also apply to a snapshot of that blob?", "abstract": "Does a lease associated with an Azure block blob also apply to a snapshot of that blob?", "articleBody": "Source facts\nMicrosoft’s block-blob guidance states that leases associated with the base blob do not affect its snapshots. A lease cannot be acquired on a snapshot itself. The CLI’s ordinary blob listing also excludes additional object types by default; the include option can request snapshots, versions and soft-deleted objects. Microsoft Learn.\nApplicability\nUse this check for an application or operator handling block blobs and snapshots through Azure CLI. Keep lease behavior, object enumeration and the separately required access or retention controls distinct.\nDSE recommendation\nDocument snapshot handling independently from the base blob’s lease. Ask the storage owner which snapshot identities the workflow creates, which callers may operate on them and what approved protection is required. Do not reuse the base object’s lease as the evidence for that decision. Make snapshot enumeration explicit in the operational inventory so a default listing does not hide objects the review intended to include. Choose any additional protection through its own supported design and approval.\nVerification\nIn an approved test container, identify the base blob and its snapshot separately and inspect the applicable lease behavior. Compare a default listing with an explicitly snapshot-inclusive listing. Verify the intended access and retention configuration through the controls that actually provide it, without attempting destructive tests on production copies. Retain any gap between assumed lease coverage and the documented snapshot model as an unresolved workflow requirement.\nOfficial references\nMicrosoft Learn: Manage block blobs with Azure CLI.", "datePublished": "2026-09-10T00:23:52+00:00", "dateModified": "2026-09-10T02:08:05+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-484-do-not-assume-a-base-blob-s-lease-governs-its-snapshot/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-484-do-not-assume-a-base-blob-s-lease-governs-its-snapshot/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not assume a base blob's lease governs its snapshot" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 237, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Manage block blobs with Azure CLI - Azure Storage | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/blob-cli" } } ] } }