# Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)

- Source: https://support.icompaas.com/support/solutions/articles/62000234815-ensure-critical-data-is-encrypted-with-customer-managed-keys-cmk-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure Storage Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112694) › [Azure Storage Services Benchmark](https://support.icompaas.com/support/solutions/folders/62000169262)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:** Level 2

**Description:** Customer Managed Keys (CMK) enable organizations to have full control over the encryption keys used to protect their critical data at rest in Azure services. CMKs are stored in Azure Key Vault or managed HSM, allowing customers to define key rotation policies, perform key lifecycle management, and revoke access independently from the service.

**Rationale:** Using CMKs enhances security by giving organizations direct control over their encryption keys, meeting strict compliance and regulatory requirements. It enables better auditability, key rotation, and revocation capabilities beyond what Microsoft Managed Keys provide. This reduces risks associated with unauthorized access to sensitive data and strengthens overall data protection.

**Impact:**

-   Pros:  
    
    -   Full control over key lifecycle management, including rotation and revocation.  
        
    -   Greater compliance support with key ownership and auditing requirements.  
        
    -   Enables separation of duties between data owners and cloud service providers.  
        
-   Cons:  
    
    -   Increased operational overhead to manage keys securely.  
        
    -   Requires proper configuration and monitoring to avoid service disruption.  
        
    -   Possible additional costs for Azure Key Vault and HSM usage.  
        

**Default Value:** By default, many Azure services use Microsoft Managed Keys for encryption unless explicitly configured for CMK.

**Pre-requisites:**

-   Azure Key Vault or Managed HSM set up with appropriate permissions.  
    
-   Access rights to configure encryption settings on Azure resources.  
    
-   Understanding of key management best practices.  
    

### **Remediation**

**Test Plan:**

**Using Azure Portal:**

1.  Navigate to [https://portal.azure.com](https://portal.azure.com/).  
    
2.  Open the relevant Azure resource (e.g., Storage Account, SQL Database, Key Vault).  
    
3.  Go to Encryption or Settings section.  
    
4.  Verify that encryption uses Customer Managed Keys from Key Vault or Managed HSM.  
    
5.  Confirm the correct key URI is configured and accessible.  
    

**Using Azure CLI:**

1\. For Storage Account, check encryption settings and keySource:  

az storage account show --name <storage-account-name> --resource-group <resource-group> --query encryption.keySource

2\. It should return Microsoft.Keyvault indicating CMK use.  
3\. For SQL Database, verify encryption protector type:

az sql server tde-key show --server <server-name> --resource-group <resource-group>

4\. Confirm it is set to AzureKeyVault.  

### **Implementation Plan**

**Using Azure Portal:**

1.  Create or select an existing Key Vault containing the customer-managed key.  
    
2.  Assign required permissions for the Azure resource to access the Key Vault key.  
    
3.  Navigate to the Azure resource’s Encryption settings.  
    
4.  Select Customer Managed Keys as the encryption method and specify the Key Vault key URI.  
    
5.  Save the configuration and validate encryption is active with CMK.  
    

**Using Azure CLI:**

1\. Assign access policy to the resource identity to Key Vault:  

az keyvault set-policy --name <keyvault-name> --object-id <resource-identity-object-id> --key-permissions get wrapKey unwrapKey

2\. Update storage account encryption settings:  

az storage account update --name <storage-account-name> --resource-group <resource-group> --encryption-key-source Microsoft.Keyvault --encryption-key-vault-uri <key-vault-key-uri>

3\. For SQL Server Transparent Data Encryption (TDE) with CMK:  

az sql server tde-key set --server <server-name> --resource-group <resource-group> --kid <key-vault-key-uri>

###   

### **Backout Plan**

**Using Azure Portal:**

1.  Switch encryption back to Microsoft Managed Keys if needed.  
    
2.  Remove or modify Key Vault access policies accordingly.  
    

**Using Azure CLI:**

1\. Reset encryption key source to Microsoft Managed Keys:  

az storage account update --name <storage-account-name> --resource-group <resource-group> --set encryption.keySource=Microsoft.Storage

2\. For SQL Server, set TDE protector back to service-managed:  

az sql server tde-key set --server <server-name> --resource-group <resource-group> --type ServiceManaged

  

References:

-   [Azure Storage Service Encryption with Customer-Managed Keys  
    ](https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption-customer-managed-keys)
    
-   [Transparent Data Encryption with Customer-Managed Keys for Azure SQL  
    ](https://learn.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-azure-key-vault)
    
-   [Azure Key Vault Overview](https://learn.microsoft.com/en-us/azure/key-vault/general/overview)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.