About
This article explains the Azure Baseline Controls check "AZURE BL 1-2 Storage Accounts - data must be encrypted with Customer Managed Keys". The check looks at whether the data in your Azure storage accounts is encrypted with a key that you control, instead of the key Microsoft manages for you. Encrypting with your own key gives you control over who can use the key that protects your data.
The result of this check appears in Monitor › Compliance Checks once the Azure integration is connected.
How Azure Storage encryption works
By default, Azure encrypts the data in a storage account at rest with Microsoft-managed keys. This covers:
- Blobs, disks, files, queues and tables.
- All object metadata.
If you want to control the encryption key yourself, you can specify a customer-managed key. That key protects and controls access to the key that encrypts your data. You can also have Azure update the key version used for storage encryption automatically whenever a new version is available in the associated Key Vault.
Fix a storage account that doesn't use a customer-managed key
The steps for switching a storage account to a customer-managed key are done in Azure, not in ControlMap. Microsoft describes them in these articles:
- Customer-managed keys for Azure Storage encryption: https://docs.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview
- Create a storage account: https://docs.microsoft.com/en-us/azure/storage/common/storage-create-storage-account
