Azure Storage Encryption (at rest)
What it is
Azure Storage service-side encryption (SSE) automatically encrypts data when it is stored in an Azure Storage account. It uses 256-bit AES, is enabled for all storage accounts, and cannot be disabled. Azure Storage encrypts and decrypts the data transparently.
Why it exists
It provides an at-rest encryption baseline without application changes. It is not a replacement for access control, network protection, or encryption in transit: a person who is authorized to read the blob can receive the decrypted data.
Key ideas
- Coverage — blobs, files, queues, tables, and their metadata in Azure Storage are encrypted. Managed disks have separate server-side encryption guidance.
- On by default — you cannot turn it off, and there is no additional Azure Storage encryption charge.
- Key management models:
- Microsoft-managed keys (default, service-side) — Azure holds the keys.
- Customer-managed keys (CMK) — you manage keys in Azure Key Vault or Key Vault Managed HSM. Blob Storage and Azure Files support them; specific account configurations also support queues and tables.
- Customer-provided keys (CPK) — for Blob Storage requests; the client supplies the key for that operation and retains responsibility for it.
- Infrastructure encryption (optional) — double encryption: a second layer of 256-bit AES in addition to the default one.
- Encryption scopes — scope key management to a container or an individual blob (e.g. separate CMK per scope).
- Data in transit is separate — use secure transport and the relevant service settings; SSE covers stored data, not a request moving across the network.
Northwind example
Northwind stores order receipts in Blob Storage. SSE already encrypts the receipts at rest with Microsoft-managed keys. For a contractual requirement that Northwind control key rotation, Maya evaluates customer-managed keys and the operational responsibility of keeping Key Vault and key permissions available. The team still uses Entra RBAC and private networking because encryption alone does not decide who may read a receipt.
How it fits (diagram)
Exam notes
- SSE is always on for Azure Storage and is transparent to the application.
- It protects data at rest; RBAC, networking, and secure transport solve separate problems.
- Customer-managed keys give more control and more operational responsibility; infrastructure encryption adds a second encryption layer.
Related
storage-account · key-vault · blob-storage · azure-files · azure-tables · azure-queues