Question

A financial services company must encrypt data in an Azure Storage account used for regulatory records. Compliance mandates that the organization control the encryption key lifecycle, including the ability to rotate and revoke keys independently of Microsoft. The security team also requires that any access to the key material be fully audited. Which approach should you recommend?

Accepted Answer

Configure customer-managed keys (CMK) stored in Azure Key Vault, grant the storage account access via a managed identity, and enable Key Vault logging.

Answer

Rely on Microsoft-managed keys for the storage account and enable diagnostic logging on the account.

Answer

Store an encryption key in an Azure Storage table and reference it from the application during read and write operations.

Answer

Enable infrastructure encryption with a double layer of Microsoft-managed keys and configure a resource lock.