# Match incremental snapshots to the disk instance, not just its reused name

> How can a snapshot inventory distinguish a recreated Azure disk from its predecessor?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-053-match-incremental-snapshots-to-the-disk-instance-not-just-its-reused-name/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:31:03+00:00
- Modified: 2026-09-10T00:35:07+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, IT
- Reading time: 2 minutes

## What you need to know

How can a snapshot inventory distinguish a recreated Azure disk from its predecessor?

## Potentially affected

Operators inventorying incremental snapshots for Azure managed disks that might be deleted and recreated under the same name.

## DSE recommendation

Match both the source resource ID and source unique ID when assigning snapshots to a particular disk instance.

## Article

## Source facts

Azure incremental snapshots expose SourceResourceId for the source disk’s resource identity and SourceUniqueId inherited from the disk’s UniqueId. Deleting a disk and creating another with the same name changes UniqueId. Microsoft’s PowerShell example uses both source values when selecting the incremental snapshots associated with one disk. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/disks-incremental-snapshots).

## Applicability

Use this check when a recovery inventory or cleanup process groups snapshots by disk name or resource path. Identify whether the source disk was replaced, recreated, or removed. Keep snapshots of an earlier disk instance visible as a separate population rather than assuming that an identical name means continuous identity.

## DSE recommendation

Match both the source resource ID and source unique ID when assigning snapshots to a particular disk instance. Preserve the original identity pair in the recovery register before retiring a disk. Ask the recovery owner to label each historical population with its intended retention and use. Review automation that selects only a disk name, especially if that selection drives restoration or deletion.

## Verification

In a disposable test, compare snapshots taken before and after a same-name disk replacement and inspect their source identity fields. Confirm that the inventory keeps those populations separate while still retaining the historical snapshots intentionally. For a recovery exercise, record the selected snapshot’s identity pair beside the intended source generation. Investigate a missing or mismatched identifier before authorizing a restore or cleanup based on that inventory.

## Official references

[Microsoft Learn: Create an incremental snapshot for managed disks](https://learn.microsoft.com/en-us/azure/virtual-machines/disks-incremental-snapshots). Source reviewed September 9, 2026.

## Primary reference

- Name: Create an incremental snapshot - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/disks-incremental-snapshots
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Match incremental snapshots to the disk instance, not just its reused name,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-053-match-incremental-snapshots-to-the-disk-instance-not-just-its-reused-name/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.