Azure Compliance ControlsAzure Synapse Analytics
Azure Synapse workspaces should use customer-managed keys to encrypt data at rest
Use customer-managed keys to control the encryption at rest of the data stored in Azure Synapse workspaces. Customer-managed keys deliver double encryption by adding a second layer of encryption on top of the default encryption with service-managed keys.
What this control checks
Checks Azure Synapse workspaces for customer-managed key encryption of data at rest
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
Related controls
- Azure Synapse workspaces should use private link
- Azure API for FHIR should use a customer-managed key to encrypt data at rest
- Storage accounts containing operational log containers should use customer-managed keys for encryption
- Key vaults should have recoverability configured
- SQL servers should have vulnerability assessment enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
synapse_workspace_encryption_at_rest_using_cmk - Checkov Check:
CKV_AZURE_240 - Powerpipe Control:
azure_compliance.control.synapse_workspace_encryption_at_rest_using_cmk - Azure Policy Definition:
f7d52b2d-e161-4dfa-a82b-55e564167385
Last reviewed: 2026-10-15