Replace the deprecated blob-tag read suboperation when reviewing ABAC conditions

Source facts

Microsoft marks the older Read content from a blob with tag conditions suboperation as deprecated and recommends using Read a blob instead. The older suboperation remains supported for compatibility with conditions created during the ABAC preview. For the documented tag-read condition to be effective, it must cover all relevant read grants and the superuser action where the role includes it. Microsoft Learn

Applicability

This guide applies when reviewing an Azure Blob Storage role condition that limits reads using blob index tags, especially one inherited from the feature’s preview period.

DSE recommendation

DSE recommends identifying the actual action or suboperation in the saved condition before revising it. Record the intended tag rule and expected behavior, then review every relevant grant for the principal. Use the current documented action in a controlled test and compare the new condition with the approved rule. Keep a copy of the original configuration for change review without assuming the deprecated label means the existing condition has stopped working.

Verification

Test a blob that matches the approved tag rule and a designated blob that does not. Review the observed result against the principal’s full assignment set, including any role with the superuser action. Retain the submitted condition and test observations, and investigate unexpected access before accepting the replacement.

Official references

• Microsoft: Example Azure role assignment conditions for Blob Storage – Azure Storage | Microsoft Learn