Do not treat Blob change feed as a complete access audit

Source facts

Blob change feed records successful mutations, including creation, modification and deletion. Its ordering guarantee is per blob; read operations and failed requests are not part of that mutation log.

Microsoft supports change feed for standard general-purpose v2, premium block blob and Blob storage accounts. Accounts with hierarchical namespace are not currently supported.

Deletion coverage also has a limit: BlobDeleted records concern the base blob, not removal of an individual version or snapshot. Microsoft Learn.

Applicability

Identify the account type, namespace setting and exact consumer requirement. Separate a mutation-processing application from an investigation that needs access attempts or cross-object chronology.

DSE recommendation

DSE recommends writing an event-coverage contract before relying on this feed. State which successful changes the application needs, how it identifies each blob and what ordering assumptions it makes. Select separately supported telemetry for reads or failures instead of labeling their absence as proof that they never occurred. Avoid turning a per-object guarantee into a global transaction sequence.

Verification

In a controlled account, compare authorized successful changes, reads and failed requests with the expected evidence sources. Distinguish a base-blob deletion from version or snapshot removal in the test inventory. Review two independently changed blobs without assuming their combined presentation proves a total order. Retain account settings and consumer interpretation with the results. Treat missing required event classes as a design gap, not an empty audit finding.

Official references

Microsoft Learn: Change feed in Blob Storage. Source retrieved September 9, 2026.