{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-135-replace-the-deprecated-blob-tag-read-suboperation-when-reviewing-abac-conditions/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260917-135-replace-the-deprecated-blob-tag-read-suboperation-when-reviewing-abac-conditions/",
        "slug": "dse-20260917-135-replace-the-deprecated-blob-tag-read-suboperation-when-reviewing-abac-conditions",
        "url": "https://update.dsesecurity.com/updates/dse-20260917-135-replace-the-deprecated-blob-tag-read-suboperation-when-reviewing-abac-conditions/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260917-135-replace-the-deprecated-blob-tag-read-suboperation-when-reviewing-abac-conditions.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-135-replace-the-deprecated-blob-tag-read-suboperation-when-reviewing-abac-conditions/"
        },
        "title": "Replace the deprecated blob-tag read suboperation when reviewing ABAC conditions",
        "summary": "DSE recommends identifying the actual action or suboperation in the saved condition before revising it.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "managed-it",
            "label": "Managed IT operations",
            "alt": "A controlled technology lifecycle progressing from assessment to approved production.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-17T16:32:45+00:00",
        "modified_at": "2026-09-17T16:42:36+00:00",
        "reviewed_on": "2026-09-17",
        "reading_minutes": 2,
        "word_count": 231,
        "potentially_affected": "This guide applies when reviewing an Azure Blob Storage role condition that limits reads using blob index tags, especially one inherited from the feature’s preview period.",
        "dse_recommendation": "DSE recommends identifying the actual action or suboperation in the saved condition before revising it.",
        "primary_source": {
            "name": "Example Azure role assignment conditions for Blob Storage - Azure Storage | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/storage-auth-abac-examples",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft marks the older Read content from a blob with tag conditions suboperation as deprecated and recommends using Read a blob instead. The older suboperation remains supported for compatibility with conditions created during the ABAC preview. For the documented tag-read condition to be effective, it must cover all relevant read grants and the superuser action where the role includes it. <a href=\"https://learn.microsoft.com/en-us/azure/storage/blobs/storage-auth-abac-examples\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a></p>\n<h2>Applicability</h2>\n<p>This guide applies when reviewing an Azure Blob Storage role condition that limits reads using blob index tags, especially one inherited from the feature’s preview period.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends identifying the actual action or suboperation in the saved condition before revising it. Record the intended tag rule and expected behavior, then review every relevant grant for the principal. Use the current documented action in a controlled test and compare the new condition with the approved rule. Keep a copy of the original configuration for change review without assuming the deprecated label means the existing condition has stopped working.</p>\n<h2>Verification</h2>\n<p>Test a blob that matches the approved tag rule and a designated blob that does not. Review the observed result against the principal’s full assignment set, including any role with the superuser action. Retain the submitted condition and test observations, and investigate unexpected access before accepting the replacement.</p>\n<h2>Official references</h2>\n<ul>\n<li><a href=\"https://learn.microsoft.com/en-us/azure/storage/blobs/storage-auth-abac-examples\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft: Example Azure role assignment conditions for Blob Storage &#8211; Azure Storage | Microsoft Learn</a></li>\n</ul>",
        "content_text": "Source facts\nMicrosoft marks the older Read content from a blob with tag conditions suboperation as deprecated and recommends using Read a blob instead. The older suboperation remains supported for compatibility with conditions created during the ABAC preview. For the documented tag-read condition to be effective, it must cover all relevant read grants and the superuser action where the role includes it. Microsoft Learn\nApplicability\nThis guide applies when reviewing an Azure Blob Storage role condition that limits reads using blob index tags, especially one inherited from the feature’s preview period.\nDSE recommendation\nDSE recommends identifying the actual action or suboperation in the saved condition before revising it. Record the intended tag rule and expected behavior, then review every relevant grant for the principal. Use the current documented action in a controlled test and compare the new condition with the approved rule. Keep a copy of the original configuration for change review without assuming the deprecated label means the existing condition has stopped working.\nVerification\nTest a blob that matches the approved tag rule and a designated blob that does not. Review the observed result against the principal’s full assignment set, including any role with the superuser action. Retain the submitted condition and test observations, and investigate unexpected access before accepting the replacement.\nOfficial references\n\nMicrosoft: Example Azure role assignment conditions for Blob Storage – Azure Storage | Microsoft Learn",
        "content_markdown": "## Source facts\n\nMicrosoft marks the older Read content from a blob with tag conditions suboperation as deprecated and recommends using Read a blob instead. The older suboperation remains supported for compatibility with conditions created during the ABAC preview. For the documented tag-read condition to be effective, it must cover all relevant read grants and the superuser action where the role includes it. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-auth-abac-examples)\n\n## Applicability\n\nThis guide applies when reviewing an Azure Blob Storage role condition that limits reads using blob index tags, especially one inherited from the feature’s preview period.\n\n## DSE recommendation\n\nDSE recommends identifying the actual action or suboperation in the saved condition before revising it. Record the intended tag rule and expected behavior, then review every relevant grant for the principal. Use the current documented action in a controlled test and compare the new condition with the approved rule. Keep a copy of the original configuration for change review without assuming the deprecated label means the existing condition has stopped working.\n\n## Verification\n\nTest a blob that matches the approved tag rule and a designated blob that does not. Review the observed result against the principal’s full assignment set, including any role with the superuser action. Retain the submitted condition and test observations, and investigate unexpected access before accepting the replacement.\n\n## Official references\n\n- [Microsoft: Example Azure role assignment conditions for Blob Storage – Azure Storage | Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-auth-abac-examples)"
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-135-replace-the-deprecated-blob-tag-read-suboperation-when-reviewing-abac-conditions/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-135-replace-the-deprecated-blob-tag-read-suboperation-when-reviewing-abac-conditions/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-17"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-135-replace-the-deprecated-blob-tag-read-suboperation-when-reviewing-abac-conditions/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Replace the deprecated blob-tag read suboperation when reviewing ABAC conditions",
                        "item": "https://update.dsesecurity.com/updates/dse-20260917-135-replace-the-deprecated-blob-tag-read-suboperation-when-reviewing-abac-conditions/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-135-replace-the-deprecated-blob-tag-read-suboperation-when-reviewing-abac-conditions/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260917-135-replace-the-deprecated-blob-tag-read-suboperation-when-reviewing-abac-conditions/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-135-replace-the-deprecated-blob-tag-read-suboperation-when-reviewing-abac-conditions/",
                "headline": "Replace the deprecated blob-tag read suboperation when reviewing ABAC conditions",
                "description": "DSE recommends identifying the actual action or suboperation in the saved condition before revising it.",
                "abstract": "DSE recommends identifying the actual action or suboperation in the saved condition before revising it.",
                "articleBody": "Source facts\nMicrosoft marks the older Read content from a blob with tag conditions suboperation as deprecated and recommends using Read a blob instead. The older suboperation remains supported for compatibility with conditions created during the ABAC preview. For the documented tag-read condition to be effective, it must cover all relevant read grants and the superuser action where the role includes it. Microsoft Learn\nApplicability\nThis guide applies when reviewing an Azure Blob Storage role condition that limits reads using blob index tags, especially one inherited from the feature’s preview period.\nDSE recommendation\nDSE recommends identifying the actual action or suboperation in the saved condition before revising it. Record the intended tag rule and expected behavior, then review every relevant grant for the principal. Use the current documented action in a controlled test and compare the new condition with the approved rule. Keep a copy of the original configuration for change review without assuming the deprecated label means the existing condition has stopped working.\nVerification\nTest a blob that matches the approved tag rule and a designated blob that does not. Review the observed result against the principal’s full assignment set, including any role with the superuser action. Retain the submitted condition and test observations, and investigate unexpected access before accepting the replacement.\nOfficial references\n\nMicrosoft: Example Azure role assignment conditions for Blob Storage – Azure Storage | Microsoft Learn",
                "datePublished": "2026-09-17T16:32:45+00:00",
                "dateModified": "2026-09-17T16:42:36+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-135-replace-the-deprecated-blob-tag-read-suboperation-when-reviewing-abac-conditions/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-135-replace-the-deprecated-blob-tag-read-suboperation-when-reviewing-abac-conditions/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Replace the deprecated blob-tag read suboperation when reviewing ABAC conditions"
                },
                "articleSection": [
                    "IT"
                ],
                "keywords": [
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 231,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Example Azure role assignment conditions for Blob Storage - Azure Storage | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/storage/blobs/storage-auth-abac-examples"
                }
            }
        ]
    }
}