Azure Storage Encryption (at rest)
What it is
Azure Storage encryption (SSE) automatically encrypts all data at rest in storage using 256-bit AES — enabled by default and unable to be disabled. It covers blobs, Azure Files, queues, tables, and managed disks.
Why it exists
To satisfy compliance and security requirements: your data is encrypted on disk without any extra setup, and encryption/decryption is fully transparent (transparent data encryption, no application changes, no performance penalty).
Key ideas
- On by default — you cannot turn it off, and it costs nothing extra.
- Key management models:
- Microsoft-managed keys (default, service-side) — Azure holds the keys.
- Customer-managed keys (CMK) — you bring keys held in Azure Key Vault; rotate/control them yourself.
- Customer-provided keys (CPK) — for blobs only; you supply the key with each request (encryption on a per-request basis, key never stored).
- Infrastructure encryption (optional) — double encryption: a second layer of 256-bit AES in addition to the default one.
- Encryption scopes — scope key management to a container or an individual blob (e.g. separate CMK per scope).
- Data in transit is a separate concern (TLS 1.2/1.3, SMB over encryption) — this feature is for at-rest data.
How it fits (diagram)
Exam notes
- SSE is always-on, transparent, free, and cannot be disabled — don’t claim “you must enable encryption.”
- Covers all storage services at rest (blobs, files, queues, tables) plus managed disks.
- For key control/compliance, choose customer-managed keys in Key Vault; infrastructure encryption for double encryption.
Related
storage-account · key-vault · blob-storage · azure-files · azure-tables · azure-queues