Double encryption protects data with two separate encryption layers, so if one layer is ever broken, the other still keeps the data safe. The first layer is service-level encryption, which encrypts data before it is written to disk. The second layer is infrastructure encryption, which adds an extra 256‑bit AES encryption at the Azure Storage hardware level. Using two different keys and two separate encryption algorithms means that a compromise of any single key or algorithm cannot expose the data.
Service-level encryption supports both platform-managed keys and customer-managed keys stored in Azure Key Vault. Infrastructure encryption always uses Microsoft-managed keys, which are stored and rotated by Azure automatically. This separation lets customers control their own keys for the primary encryption layer while relying on Azure’s platform for the second layer, helping meet strict compliance standards.
Infrastructure encryption must be enabled when you create a new storage account or encryption scope, and once enabled it cannot be turned off or modified. You can enable it through the Azure portal by ticking Enable infrastructure encryption on the Encryption tab, using PowerShell with the -RequireInfrastructureEncryption parameter, using Azure CLI with --require-infrastructure-encryption, or setting "requireInfrastructureEncryption": true in an ARM template.
After deployment, you validate that both encryption layers are active and monitor for issues using Azure tools. In the portal, the storage account’s Encryption blade shows both layers. You can also check the RequireInfrastructureEncryption field with PowerShell or CLI. Azure Monitor metrics and diagnostic logs can surface encryption failures or non‑compliance events, and you can set alerts on EncryptionRead and EncryptionWrite operation results to react quickly to problems.
A layered stack showing customer data protected by two encryption layers: service-level encryption using platform or customer-managed keys, and infrastructure-level encryption using Microsoft-managed keys.
Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Prepare and test your skills
Prepare and test your skills
Double encryption protects data with two separate encryption layers, service-level and infrastructure, so if one layer is broken the other still keeps data safe. It uses two different keys and two separate encryption algorithms, so compromising any single key or algorithm cannot expose the data.
Infrastructure encryption must be enabled when you create a new storage account or encryption scope, and once enabled it cannot be turned off or modified. You can enable it through the Azure portal by ticking Enable infrastructure encryption on the Encryption tab, using PowerShell with the -RequireInfrastructureEncryption parameter, using Azure CLI with --require-infrastructure-encryption, or setting requireInfrastructureEncryption to true in an ARM template.
After deployment, you can validate that both encryption layers are active using Azure tools. In the Azure portal, the storage account's Encryption blade shows both layers. You can also check the RequireInfrastructureEncryption field with PowerShell or CLI. Additionally, Azure Monitor metrics and diagnostic logs can surface encryption failures or non-compliance events, and you can set alerts on EncryptionRead and EncryptionWrite operation results.
StudyCerts
StudyCerts