# Validate Blob inventory output before accepting its completion event

> Distinguish an inventory event from a usable report and account for all files named in the manifest.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-222-validate-blob-inventory-output-before-accepting-its-completion-event/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:28:14+00:00
- Modified: 2026-09-10T01:20:46+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Distinguish an inventory event from a usable report and account for all files named in the manifest.

## Potentially affected

Workflows consuming Azure Blob inventory events, manifests and report files.

## DSE recommendation

Check the run outcome and manifest evidence before allowing an inventory-driven workflow to proceed.

## Article

## Source facts

BlobInventoryPolicyCompleted can be raised for a run that fails before processing begins, such as an invalid policy or missing destination container. The event name alone therefore does not establish a successful report.

Microsoft says generation of the checksum file marks completion of a rule run. That checksum covers the manifest, which describes the rule’s generated inventory files. A large inventory can produce multiple report files. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/blobs/blob-inventory).

## Applicability

Identify the inventory rule, destination and downstream consumer. Decide which run and rule definition the consumer expects; do not substitute a report left by an earlier run when current output is missing.

## DSE recommendation

DSE recommends a report-acceptance step that checks the event outcome, corresponding manifest and checksum, and the expected set of output files. Record a failed or incomplete run as such and keep dependent analysis on hold. Avoid selecting the first matching CSV or Parquet file and silently treating it as the whole inventory.

## Verification

Test the consumer against a successful run, a documented pre-run failure scenario and a run represented by multiple files. Confirm it associates all evidence with the correct rule and run. Verify that missing output creates an actionable failure instead of an empty-success report. Retain the accepted manifest and file list alongside the resulting analysis for later reconciliation.

## Official references

[Microsoft Learn: Azure Storage blob inventory](https://learn.microsoft.com/en-us/azure/storage/blobs/blob-inventory). Source retrieved September 9, 2026.

## Primary reference

- Name: Azure Storage blob inventory | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/storage/blobs/blob-inventory
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Validate Blob inventory output before accepting its completion event,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-222-validate-blob-inventory-output-before-accepting-its-completion-event/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.