Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Customer-Managed Keys (CMK) let you bring your own encryption key to protect data in Azure Storage instead of letting Microsoft manage the keys. This approach meets strict regulatory compliance and data sovereignty requirements because you keep full control over who can use the key and when it gets replaced. The key lives in Azure Key Vault or Managed HSM, which are secure hardware and software services designed specifically for storing cryptographic keys. When you use CMK, Azure Storage must request access to the key whenever it needs to encrypt or decrypt data, which means the key never leaves your controlled environment. This separation between key management and data storage creates a stronger security boundary than platform-managed keys.
To enable customer-managed encryption on a storage account, open the storage account settings and go to the Encryption tab. Select the encryption type called Customer-managed keys (CMK) and choose which Azure service will hold the key—either a key vault or Managed HSM. You then either browse to select a specific key vault and key name, or you paste the full URI of the key including its version. The storage account needs a managed identity to authenticate to the key vault, so you must assign a user-assigned identity that has been pre-created with the right permissions. After selecting the identity and key, save the configuration, and Azure Storage begins using your key for all encryption operations on blobs, files, tables, and queues.
You can create and configure storage accounts with CMK already enabled using PowerShell or Azure CLI, which also sets up automatic key rotation. The commands specify the key vault URI, key name, and the managed identity that will access the key. When you use these automation commands, Azure Storage automatically detects new key versions as they are created in the key vault and begins using them without requiring manual updates. This automatic version tracking keeps encryption working continuously even when keys are rotated on a schedule. Teams that need continuous cryptographic hygiene often prefer this automated approach because it reduces the risk of service interruption during key changes.
If your organization requires manual approval before rotating encryption keys, you can disable automatic version updates and specify an exact key version. To do this, enter the full key URI including the version number when configuring the storage account, or use the update commands with the specific version parameter. When you later create a new key version in the key vault, Azure Storage continues using the old version until you explicitly update the storage account configuration to point to the new version. This gives security teams time to validate new key versions in test environments before deploying them to production. The tradeoff is that someone must remember to update the storage account when rotation is needed, which creates operational overhead.
Proper CMK security requires configuring both key vault access policies and Azure RBAC roles to enforce least-privilege access. The storage account's managed identity needs Get, Unwrap Key, and Wrap Key permissions on the key vault to perform encryption and decryption operations. Azure provides the Storage Account Key Operator Service Role for more granular control over how the storage account can use keys. You should also enable Soft Delete and Purge Protection on the key vault to retain deleted key versions and prevent permanent loss of encryption capability. Establishing an automated key rotation schedule in Key Vault, combined with these access controls, satisfies most audit requirements for cryptographic hygiene while keeping your data protected.
Prepare and test your skills
Prepare and test your skills
The storage account managed identity requires Get, Unwrap Key, and Wrap Key permissions on Azure Key Vault to perform encryption and decryption operations. Azure also provides the Storage Account Key Operator Service Role to give more granular control over key usage.
Azure Storage automatically detects new key versions as they are created in the key vault and begins using them without requiring manual updates. This automated tracking maintains continuous encryption operations during scheduled key rotations.
Azure Key Vault should have Soft Delete and Purge Protection enabled to protect customer-managed encryption keys. These settings retain deleted key versions and prevent the permanent loss of encryption capability.
StudyCerts
StudyCerts