Azure Compliance ControlsAzure Event Hubs
Event Hub namespaces should use a customer-managed key for encryption
Azure Event Hubs supports encrypting data at rest with either Microsoft-managed keys (default) or customer-managed keys. Event Hub only supports encryption with customer-managed keys for namespaces in dedicated clusters.
What this control checks
Event Hub namespaces should use a customer-managed key for encryption
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
Related controls
- Azure Machine Learning workspaces should use customer-managed keys for encryption
- PostgreSQL servers should use customer-managed keys to encrypt data at rest
- Azure Synapse workspaces should use customer-managed keys to encrypt data at rest
- Azure Data Explorer clusters should use customer-managed keys for encryption at rest
- Key vaults should have soft delete enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
eventhub_namespace_cmk_encryption_enabled - Powerpipe Control:
azure_compliance.control.eventhub_namespace_cmk_encryption_enabled - Azure Policy Definition:
a1ad735a-e96f-45d2-a7b2-9a4932cab7ec
Last reviewed: 2026-10-13