# Route blob immutability changes outside Storage Explorer’s access-policy editor

> DSE recommends identifying the requested policy type before choosing the tool or approving the change.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-048-route-blob-immutability-changes-outside-storage-explorers-access-policy-editor/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:12+00:00
- Modified: 2026-09-17T16:35:04+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 1 minutes

## What you need to know

DSE recommends identifying the requested policy type before choosing the tool or approving the change.

## Potentially affected

This applies when a storage operator receives a blob-container policy request and is considering the Access Policies dialog in Azure Storage Explorer.

## DSE recommendation

DSE recommends identifying the requested policy type before choosing the tool or approving the change.

## Article

## Source facts

Microsoft’s Blob Storage guide describes adding, editing, and removing container access policies in Storage Explorer. The guide explicitly states that Storage Explorer does not support modifying immutability policies. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/storage-explorer/vs-azure-tools-storage-explorer-blobs)

## Applicability

This applies when a storage operator receives a blob-container policy request and is considering the Access Policies dialog in Azure Storage Explorer.

## DSE recommendation

DSE recommends identifying the requested policy type before choosing the tool or approving the change. Ask the data owner to describe the intended access or retention outcome and record the exact container. If the request concerns immutability, route it to the appropriate documented management procedure and responsible owner. Keep that request separate from edits to the access policies shown in Storage Explorer, even when both requests refer to the same container.

## Verification

Review the request, selected policy type, and management path before any mutation. For an access-policy edit, compare the resulting policy list with the approved values. For an immutability request, retain the handoff and require evidence from the relevant management path. Do not mark retention work complete merely because the Storage Explorer access-policy dialog saved successfully.

## Official references

- [Microsoft: Manage Azure Blob Storage resources with Storage Explorer | Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/storage-explorer/vs-azure-tools-storage-explorer-blobs)

## Primary reference

- Name: Manage Azure Blob Storage resources with Storage Explorer | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/storage/storage-explorer/vs-azure-tools-storage-explorer-blobs
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Route blob immutability changes outside Storage Explorer’s access-policy editor,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-048-route-blob-immutability-changes-outside-storage-explorers-access-policy-editor/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.