About

This check is part of the Azure Baseline Controls that ControlMap runs against your Azure subscription. Azure encrypts storage accounts by default with Microsoft-managed keys. This check confirms that the default encryption hasn't been changed or interfered with, so the data in your storage accounts stays encrypted at rest.

When a storage account fails the check, use the steps below to fix it in the Azure portal.

Find the check in ControlMap

1. Go to Monitor › Compliance Checks.
2. In Search compliance checks, enter the check title, AZURE BL 1-4 Storage Accounts data at rest must be encrypted.
3. Look at the Status column. It shows Passing, Failing, Error or No Data.
4. To see the results behind the status, open the menu Compliance check actions for the row, select View Evidence and open the Scan results tab.

Fix it in the Azure portal

Do these steps for each storage account that fails the check:

1. In the Azure portal, go to Storage accounts.
2. Select the storage account you want to fix.
3. Select Encryption.
4. Set the encryption type to Customer-managed keys.
5. To set up encryption with your own key, choose Select from the key vault or Enter key URI.
6. Save the setting before you leave the page.

Check that it's fixed

ControlMap checks your Azure subscription on the schedule set for the connection. To see the result sooner:

1. Go to Monitor › Integrations and select your Azure connection.
2. Select Run Once. A message says the scan will start in the next few minutes.
3. When the scan finishes, go back to Monitor › Compliance Checks and look at the Status of the check again.

Learn more

Microsoft explains how Azure Storage encryption works in Azure Storage encryption for data at rest.