# Ensure Use Infrastructure Encryption for This Vault Is Enabled on Recovery Services Vaults

- Source: https://support.icompaas.com/support/solutions/articles/62000234846-ensure-use-infrastructure-encryption-for-this-vault-is-enabled-on-recovery-services-vaults
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure Storage Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112694) › [Azure Storage Services Benchmark](https://support.icompaas.com/support/solutions/folders/62000169262)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:** Level 2

**Description:** Infrastructure encryption provides an additional, second layer of encryption for backup data stored in Azure Recovery Services Vaults. This feature encrypts data at rest twice—first by service encryption and then by infrastructure encryption—offering enhanced protection against threats targeting encryption layers or hardware vulnerabilities.

**Rationale:** Enabling infrastructure encryption strengthens data security by adding defense in depth, ensuring that backup data is doubly encrypted. This helps meet rigorous compliance and regulatory requirements and provides greater assurance for sensitive and critical backup data confidentiality and integrity.

**Impact:**

-   Pros:  
    
    -   Provides enhanced protection with double encryption at rest.  
        
    -   Meets stringent compliance and audit requirements.  
        
    -   Protects against potential hardware or software vulnerabilities affecting encryption.  
        
-   Cons:  
    
    -   May cause a slight performance impact on backup and restore operations.  
        
    -   Only available in supported regions and vault types; verify compatibility.  
        

Default Value: Infrastructure encryption is disabled by default and must be explicitly enabled on Recovery Services Vaults.

**Pre-requisites:**

-   Recovery Services Vault configured for backups.  
    
-   Permissions to modify vault encryption settings.  
    

### **Remediation**

**Test Plan:**

**Using Azure Portal:**

1.  Log in to [https://portal.azure.com](https://portal.azure.com/).  
    
2.  Navigate to Recovery Services Vaults and select the target vault.  
    
3.  Under Properties or Encryption settings, verify if Use infrastructure encryption for this vault is enabled.  
    

**Using Azure CLI:**

1\. Check infrastructure encryption status:  

az backup vault show --name <vault-name> --resource-group <resource-group> --query properties.encryptionSettings.infrastructureEncryptionEnabled

2\. Confirm the returned value is true.  

### **Implementation Plan**

**Using Azure Portal:**

1.  In the vault’s Encryption settings, enable Use infrastructure encryption for this vault.  
    
2.  Save changes and validate the setting.  
    

**Using Azure CLI:**

1\. Enable infrastructure encryption on the vault:  

az backup vault encryption enable --vault-name <vault-name> --resource-group <resource-group> --infrastructure-encryption-enabled true

2\. Confirm the update by retrieving vault properties.  

### **Backout Plan**

**Using Azure Portal:**

1.  Disable infrastructure encryption by unchecking the feature in vault settings if required.  
    
2.  Evaluate any security or compliance implications.  
    

**Using Azure CLI:**

1\. Disable infrastructure encryption:  

az backup vault encryption enable --vault-name <vault-name> --resource-group <resource-group> --infrastructure-encryption-enabled false

  

**References:**

-   [Azure Backup Infrastructure Encryption  
    ](https://learn.microsoft.com/en-us/azure/backup/backup-infrastructure-encryption)
    
-   [Manage Encryption for Recovery Services Vault](https://learn.microsoft.com/en-us/azure/backup/backup-encryption-overview)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.