Azure Compliance ControlsAzure SQL Managed Instance
SQL managed instances should use customer-managed keys to encrypt data at rest
Implementing Transparent Data Encryption (TDE) with your own key provides increased transparency and control over the TDE Protector. It also provides increased security with an HSM-backed external service and promotion of separation of duties.
What this control checks
Checks whether SQL managed instances use customer-managed keys for encryption at rest
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
- 0304.09o3Organizational.1-09.o 09.07 Media Handling
Related controls
- Azure Synapse workspaces should use customer-managed keys to encrypt data at rest
- HPC Cache accounts should use customer-managed keys for encryption
- Unattached managed disks should be encrypted with ADE or customer-managed keys
- SQL databases should have transparent data encryption enabled
- Key vaults should have deletion protection enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
mssql_managed_instance_encryption_at_rest_using_cmk - Powerpipe Control:
azure_compliance.control.mssql_managed_instance_encryption_at_rest_using_cmk - Azure Policy Definition:
ac01ad65-10e5-46df-bdd9-6b0cad13e1d2
Last reviewed: 2026-10-13