When using Azure Microsoft - Managed Keys or Service-managed keys. Is there a provision to request Microsoft by the customer to disable the keys .

Question

When using Azure Microsoft - Managed Keys or Service-managed keys. Is there a provision to request Microsoft by the customer to disable the keys . Are there any inherent disadvantages of using Azure Microsoft - Managed Keys or Service-managed keys vs using Customer- Managed keys. What additional Controls do Customer Managed keys provide for Azure.

Answer 1

There is no provision for customers to request Microsoft to disable Azure Microsoft-Managed Keys or Service-Managed Keys. These keys are managed entirely by Microsoft and cannot be modified or disabled by customers. However, customers can use Customer-Managed Keys (CMK) to have more control over their data encryption. CMK allows customers to manage their own encryption keys, which can be rotated or revoked as needed. Using CMK can provide additional controls for data security and compliance. In terms of inherent disadvantages, Microsoft-Managed Keys and Service-Managed Keys may not provide the same level of control and customization as CMK. However, they can still provide strong encryption for data at rest without the added complexity of managing encryption keys.

---

References:

• Use customer-managed keys with Azure Machine Learning
• Configure customer-managed keys for your Azure Cosmos DB account with Azure Key Vault - Frequently asked questions
• Implement encryption with Customer-Managed Keys in Microsoft Cloud for Sovereignty - Select data encryption features
• Configure customer-managed keys for Azure Load Testing with Azure Key Vault - Frequently asked questions
• Customer-managed keys for Azure managed disks