https://techcommunity.microsoft.com/discussions/microsoftdefendercloud/is-setting-an-index-tag-in-azure-defender-for-cloud-during-file-write-an-atomic-/4436620

Hello Iacono, Vito

Please be informed that when you upload a blob with index tags, the blob itself is immediately available, but the tags may not be immediately indexed for ABAC policy evaluation. This creates a race condition where your ABAC policy might deny access because it can't see the required tag yet.

Hence you can Implement Retry Logic with Exponential Backoff

// Pseudo-code approach
async Task<BlobDownloadInfo> ReadBlobWithRetry(string blobName, TimeSpan maxWait = TimeSpan.FromSeconds(10))
{
    var retryAttempts = 0;
    var maxRetries = 5;
    var baseDelay = TimeSpan.FromMilliseconds(100);
    
    while (retryAttempts < maxRetries)
    {
        try 
        {
            return await blobClient.DownloadAsync();
        }
        catch (RequestFailedException ex) when (ex.Status == 403) // Authorization failed
        {
            if (retryAttempts == maxRetries - 1) throw;
            
            var delay = TimeSpan.FromMilliseconds(baseDelay.TotalMilliseconds * Math.Pow(2, retryAttempts));
            await Task.Delay(delay);
            retryAttempts++;
        }
    }
}

Post which Structure your ABAC policies to handle the propagation window: Use a composite condition that allows access either by tag OR by being the uploader Include time-based conditions for recently uploaded blobs Use container-level permissions temporarily

Also Verify Tag Propagation Before Reading

async Task<bool> VerifyTagPropagation(BlobClient blobClient, Dictionary<string, string> expectedTags)
{
    try 
    {
        var response = await blobClient.GetTagsAsync();
        return expectedTags.All(expected => 
            response.Value.ContainsKey(expected.Key) && 
            response.Value[expected.Key] == expected.Value);
    }
    catch 
    {
        return false;
    }
}

Note- Always implement retry logic for reads immediately after tagged uploads Design ABAC policies to be resilient during tag propagation windows Consider using ETags alongside tags for immediate consistency check. The tag propagation delay is typically measured in seconds, not minutes, but the exact timing can vary based on load and traffic patterns in your storage account.

Let me know if you have any questions or concerns, I'm here to assist you.

Hello Iacono, Vito

I wanted to follow-up to see if you had the chance to see the above comment. Let know if you have any questions or concerns in comment, I'm here to assist you.