# Use blob-relative values in Azure Storage path conditions

> Check container names, leading slashes, and URL encoding before diagnosing an ABAC path or prefix mismatch.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-180-use-blob-relative-values-in-azure-storage-path-conditions/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:28:56+00:00
- Modified: 2026-09-10T00:55:36+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Check container names, leading slashes, and URL encoding before diagnosing an ABAC path or prefix mismatch.

## Potentially affected

Azure Blob Storage role-assignment conditions using path or prefix attributes.

## DSE recommendation

Compare condition values with the blob-relative path and test intended and excluded objects before widening access.

## Article

## Source facts

For the Blob path attribute, Microsoft says condition values omit the container name and any leading slash. The path characters are supplied without URL encoding. The same formatting instructions apply to the Blob prefix attribute.

Available condition attributes also depend on the selected actions. Selecting several actions together can reduce the available attributes because each selected action must support them. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-auth-abac-attributes).

## Applicability

Identify the exact role-assignment condition, selected actions, container, and intended blob-relative path. Separate the resource’s full URL from the attribute value used in the condition, and check the current source’s feature status for any additional attributes.

## DSE recommendation

DSE recommends a condition test table showing the intended object, the actual value entered, and the expected authorization result. Review formatting errors before changing the role scope or removing a condition. Have the data owner approve any expansion of the allowed prefix; a failed request should not automatically justify broader access.

## Verification

Using a controlled identity and harmless blobs, test an intended path and a neighboring excluded path. Include a name containing characters that require URL encoding in a request URL, while keeping the condition value in the documented form. Inspect the selected actions and effective assignments, then preserve the condition and observed results without copying sensitive data.

## Official references

[Microsoft Learn: Actions and attributes for Azure role assignment conditions for Azure Blob Storage](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-auth-abac-attributes). Source retrieved September 9, 2026.

## Primary reference

- Name: Actions and attributes for Azure role assignment conditions for Azure Blob Storage - Azure Storage | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/storage/blobs/storage-auth-abac-attributes
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Use blob-relative values in Azure Storage path conditions,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-180-use-blob-relative-values-in-azure-storage-path-conditions/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.