# Do not use editable blob scan tags as the sole release control

> Which Defender for Storage result channel should a security-sensitive file-release workflow trust?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-391-do-not-use-editable-blob-scan-tags-as-the-sole-release-control/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:25:25+00:00
- Modified: 2026-09-10T02:01:56+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Which Defender for Storage result channel should a security-sensitive file-release workflow trust?

## Potentially affected

Applications consuming Defender for Storage malware scan results for Azure blobs.

## DSE recommendation

Use a reviewed result channel for release decisions and handle incomplete or failed scans explicitly.

## Article

## Source facts

Defender for Storage can write scan outcomes and scan time into blob index tags. These tags are editable by identities with tag-modification permission, so Microsoft warns against using them as the only security control. It recommends alerts, Event Grid events or Log Analytics for security-sensitive workflows. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/defender-for-cloud/introduction-malware-scanning).

Scanning does not itself interrupt an application’s access to the blob, and scan duration varies. Event Grid result delivery needs additional configuration and does not support topics with public network access disabled. Optional Log Analytics collection records scan results in StorageMalwareScanningResults. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/defender-for-cloud/introduction-malware-scanning).

## Applicability

Use this design review for applications consuming Defender for Storage malware scan results for Azure blobs. Review the source’s supported content and storage configuration before relying on scanning. A display tag should not silently become the authority for distributing uploaded content.

## DSE recommendation

DSE recommends documenting the exact event or record that permits downstream release. Separate an affirmative scan result from missing, failed or unfinished processing, and define who resolves each exception. Review the permissions of identities that can modify blob tags. Choose a result-delivery route compatible with the approved network design rather than weakening that design merely to obtain notifications.

## Verification

In an isolated test workflow, compare the authoritative scan result with the blob’s displayed tags and the application’s release decision. Include delayed and unsuccessful processing cases. Confirm that changing a tag alone cannot authorize release. Retain the input identity, result evidence and downstream decision without claiming that an undetected file is guaranteed harmless.

## Official references

[Microsoft Learn: Introduction to malware scanning](https://learn.microsoft.com/en-us/azure/defender-for-cloud/introduction-malware-scanning).

## Primary reference

- Name: Introduction to Defender for Storage malware scanning - Microsoft Defender for Cloud | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/defender-for-cloud/introduction-malware-scanning
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Do not use editable blob scan tags as the sole release control,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-391-do-not-use-editable-blob-scan-tags-as-the-sole-release-control/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.