# Verify Resource Graph candidates against the provider before irreversible actions

> An asynchronously indexed resource list is useful for discovery, but stale state must not directly authorize destructive automation.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-355-verify-resource-graph-candidates-against-the-provider-before-irreversible-actions/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:26:01+00:00
- Modified: 2026-09-10T02:01:55+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

An asynchronously indexed resource list is useful for discovery, but stale state must not directly authorize destructive automation.

## Potentially affected

Azure automation that selects resources through Resource Graph and then performs customer-impacting actions.

## DSE recommendation

Use Resource Graph for selection and the owning resource provider for the final state check.

## Article

## Source facts

Azure Resource Graph indexes control-plane data asynchronously and can lag behind the owning resource provider. Microsoft recommends a hybrid approach for critical decisions: discover at scale through Resource Graph, then verify current state with the provider immediately before irreversible action.

A query immediately after creation can report not found even though the resource exists. The guidance advises provider fallback for this case and warns against verifying through the provider on every ordinary poll, which defeats the scaling benefit and can trigger throttling. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/resource-graph/choose-query-strategy).

## Applicability

Identify the selection query, intended action and provider operation that establishes the necessary current state. Distinguish a stale negative result from confirmed absence.

## DSE recommendation

DSE recommends separating candidate discovery from action authorization in the workflow. Immediately before an irreversible step, recheck the exact resource and decision-relevant properties through the provider. Stop if the state differs from the approved conditions or cannot be established. Do not reinterpret a failed freshness check as permission to delete, recreate or restart the resource.

## Verification

In a nonproduction test, introduce an authorized resource-state change between selection and execution. Confirm that the final check detects the difference and stops the proposed action. Test the recently created-resource case separately. Retain both observations and their times so the automation’s decision can be explained without presenting the indexed result as a guaranteed current snapshot.

## Official references

[Microsoft Learn: Choose the right query strategy for Azure Resource Graph](https://learn.microsoft.com/en-us/azure/governance/resource-graph/choose-query-strategy). Source retrieved September 9, 2026.

## Primary reference

- Name: Choose the right query strategy for Azure Resource Graph - Azure Resource Graph | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/governance/resource-graph/choose-query-strategy
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Verify Resource Graph candidates against the provider before irreversible actions,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-355-verify-resource-graph-candidates-against-the-provider-before-irreversible-actions/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.