About
"Storage Accounts that include activity logs should be encrypted with Customer Managed Keys" is one of the compliance checks that runs when you connect your client's Azure subscription to ControlMap with the Azure integration. The checks come from the "Azure Baseline Controls" set. ControlMap reads the Azure environment and shows whether the check is passing, so you can see the result next to your client's other compliance evidence.
How Azure encrypts storage account data
By default, Azure encrypts the data in a storage account at rest using Microsoft-managed keys. This covers all Azure Storage resources, including blobs, disks, files, queues and tables, and all object metadata is encrypted too.
If you want to control and manage the encryption key yourself, you can specify a customer-managed key. That key protects and controls access to the key that encrypts the data. You can also have Azure automatically update the key version used for storage encryption whenever a new version is available in the associated Key Vault.
Where the check appears in ControlMap
To find the check and its result:
- Go to Monitor › Compliance Checks.
- In the search box, type "Storage Accounts that include activity logs". You can also narrow the list with the All integrations filter.
- Read the Status column. It shows Passing, Failing, Error or No Data.
- Open the menu in the Actions column and select View Evidence. The Scan results tab shows what the last scan found.
The Controls and Objectives columns show which controls and objectives the check counts toward. To change that, open the Actions menu and select Manage Mappings.
If the status is No Data, the check has not run yet, or the resources it tests do not exist yet in the connected Azure environment.
