Customer-Managed Keys for Azure Storage Encryption

What Azure Key Vault is

Azure Key Vault is a centralized cloud service for securely storing, managing, and controlling access to application secrets, cryptographic keys, and digital certificates. It provides hardware security module (HSM) backed protection and robust access policies to safeguard critical credentials and cryptographic material.

How it meets the compliance requirement

When configuring Azure Storage encryption for data at rest, organizations can choose between Microsoft-managed keys (the default) and customer-managed keys (CMK). By integrating Azure Storage with Azure Key Vault, organizations can create, store, and manage their own encryption keys. This ensures that the organization maintains direct ownership and oversight of the keys used to encrypt and decrypt stored blob and file data.

Key advantages and capabilities

• Centralized key management: Consolidates cryptographic key creation, rotation, and lifecycle controls into a dedicated, secure repository.
• Full key lifecycle control: Enables organizations to rotate, revoke, backup, and delete keys according to corporate security policies.
• Granular access monitoring: Integrates with logging tools to provide full visibility into every attempt to access or use the cryptographic keys.
• Regulatory compliance: Assists organizations in meeting stringent regulatory mandates that prohibit third-party management of root encryption keys.

Why this is optimal

Azure Key Vault is the native and optimal solution in Microsoft Azure for managing customer-managed encryption keys. It seamlessly coordinates with Azure Storage to provide envelope encryption, allowing automated data protection while leaving key governance entirely under administrative control.