Storage security
Azure Storage encryption
Service-side encryption and customer-managed key configuration.
Key points
- Storage service encryption protects data at rest by default.
- Microsoft-managed keys minimize key operations; customer-managed keys add customer lifecycle control.
- Customer-managed keys require a healthy key resource and authorized storage identity.
Best-known use cases
- Meet a requirement to control storage encryption keys.
- Revoke or rotate a customer-managed key under governed procedures.
What candidates often confuse it with
- Microsoft-managed vs customer-managed keys: Azure lifecycle vs customer-controlled key lifecycle.
- Encryption vs authorization: protect stored bytes vs decide who may perform data actions.
Key takeaway
Use customer-managed keys only when the required control justifies the added identity and key-availability dependencies.
Related services
- Azure Storage accounts
- Azure Storage Explorer
- AzCopy
Relevant exam tasks
- D2.2.S1 — Create and configure storage accounts
- D2.2.S4 — Configure storage account encryption
- D2.2.S5 — Manage data by using Azure Storage Explorer and AzCopy