Event Hub namespaces should use a customer-managed key for encryption
Azure Event Hubs supports encrypting data at rest with either Microsoft-managed keys (default) or customer-managed keys. Event Hub only supports encryption with customer-managed keys for namespaces in dedicated clusters.
Choosing to encrypt data using customer-managed keys enables you to assign, rotate, disable, and revoke access to the keys that Event Hub will use to encrypt data in your namespace.
What this control checks
Event Hub namespaces should use a customer-managed key for encryption
Common pitfalls
Microsoft-managed keys are the default
Azure Event Hubs supports the option of encrypting data at rest with either Microsoft-managed keys (default) or customer-managed keys.
Only dedicated clusters support customer-managed keys
Note that Event Hub only supports encryption with customer-managed keys for namespaces in dedicated clusters.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Event Hub namespaces should use a customer-managed key for encryption" (a1ad735a-e96f-45d2-a7b2-9a4932cab7ec); PowerPipe control azure_compliance.control.eventhub_namespace_cmk_encryption_enabled.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-12 (Cryptographic Key Establishment and Management).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-12 (Cryptographic Key Establishment And Management).
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
Related controls
- Azure Machine Learning workspaces should use customer-managed keys for encryption
- PostgreSQL servers should use customer-managed keys to encrypt data at rest
- Azure Synapse workspaces should use customer-managed keys to encrypt data at rest
- Azure Data Explorer clusters should use customer-managed keys for encryption at rest
- Key vaults should have soft delete enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
eventhub_namespace_cmk_encryption_enabled - Powerpipe Control:
azure_compliance.control.eventhub_namespace_cmk_encryption_enabled - Azure Policy Definition:
a1ad735a-e96f-45d2-a7b2-9a4932cab7ec
Last reviewed: 2026-10-13