Azure Compliance ControlsAzure Storage
Storage accounts should use Microsoft-managed key for encryption
Evaluates the encryption at rest setting of storage accounts against the expectation that they use a Microsoft-managed key for encryption. The Microsoft-managed key is the default and simplest option for encryption at rest.
What this control checks
Storage accounts should use Microsoft-managed key for encryption.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_encryption_at_rest_using_mmk - Powerpipe Control:
azure_compliance.control.storage_account_encryption_at_rest_using_mmk
Last reviewed: 2026-10-15