Do not assume a base blob's lease governs its snapshot

Source facts

Microsoft’s block-blob guidance states that leases associated with the base blob do not affect its snapshots. A lease cannot be acquired on a snapshot itself. The CLI’s ordinary blob listing also excludes additional object types by default; the include option can request snapshots, versions and soft-deleted objects. Microsoft Learn.

Applicability

Use this check for an application or operator handling block blobs and snapshots through Azure CLI. Keep lease behavior, object enumeration and the separately required access or retention controls distinct.

DSE recommendation

Document snapshot handling independently from the base blob’s lease. Ask the storage owner which snapshot identities the workflow creates, which callers may operate on them and what approved protection is required. Do not reuse the base object’s lease as the evidence for that decision. Make snapshot enumeration explicit in the operational inventory so a default listing does not hide objects the review intended to include. Choose any additional protection through its own supported design and approval.

Verification

In an approved test container, identify the base blob and its snapshot separately and inspect the applicable lease behavior. Compare a default listing with an explicitly snapshot-inclusive listing. Verify the intended access and retention configuration through the controls that actually provide it, without attempting destructive tests on production copies. Retain any gap between assumed lease coverage and the documented snapshot model as an unresolved workflow requirement.

Official references

Microsoft Learn: Manage block blobs with Azure CLI.