# Ensure That ‘Enable Infrastructure Encryption’ for Each Storage Account in Azure Storage Is Set to ‘Enabled’

- Source: https://support.icompaas.com/support/solutions/articles/62000234870-ensure-that-enable-infrastructure-encryption-for-each-storage-account-in-azure-storage-is-set-to-e
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure Storage Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112694) › [Azure Storage Services Benchmark](https://support.icompaas.com/support/solutions/folders/62000169262)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability:

-   **Level 2**

Description:  
 Infrastructure encryption provides an additional layer of encryption for data at rest in Azure Storage Accounts, encrypting data twice—once with service-managed encryption and then again with infrastructure encryption. Enabling this setting enhances data protection by adding defense in depth.

Rationale:  
 By enabling infrastructure encryption, organizations strengthen the security of stored data, ensuring higher protection against potential hardware vulnerabilities and advanced threats. This supports compliance with stringent regulatory requirements.

Impact:

Pros:  

-   Adds a second encryption layer to protect data at rest.  
    
-   Enhances compliance and security posture.  
    

Cons:  

-   May incur a minor performance impact.  
    
-   Available only in supported regions and storage account types.  
    

Default Value:  
 Infrastructure encryption is disabled by default and requires explicit enabling.

Pre-requisites:

-   Azure subscription with permissions to modify storage account encryption settings.  
    
-   Storage accounts created in supported regions and types.  
    

### Remediation

Test Plan:

**Using Azure Portal:**

1.  Sign in to [https://portal.azure.com](https://portal.azure.com/).  
    
2.  Navigate to Storage Accounts and select the target account.
    
3.  Check Encryption settings to verify that Infrastructure encryption is enabled
    

**Using Azure CLI:**

1.  Check infrastructure encryption status:  
    
    az storage account show --name --resource-group --query encryption.infrastructureEncryption.enabled
    
2.  Confirm the value is true.  
    

### Implementation Plan

**Using Azure Portal:**

1.  In the storage account’s Encryption settings, enable Infrastructure encryption.  
    
2.  Save the configuration.  
    
3.  Verify data encryption status.  
    

**Using Azure CLI:**

1.  Enable infrastructure encryption:  
    
    az storage account encryption-scope update --account-name --resource-group --name --set infrastructureEncryptionEnabled=true
    
2.  Confirm the update.  
    

### **Backout Plan**

**Using Azure Portal:**

1.  Disable infrastructure encryption if necessary (if supported).  
    
2.  Assess security implications.  
    

**Using Azure CLI:**

1.  Disable infrastructure encryption:  
    
    az storage account encryption-scope update --account-name --resource-group --name --set infrastructureEncryptionEnabled=false
    

References:

-   [Azure Storage Infrastructure Encryption  
    ](https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption-infrastructure-encryption)[Manage Encryption Scopes  
    ](https://learn.microsoft.com/en-us/azure/storage/blobs/encryption-scopes-overview)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.