Storage account - Infrastructure level encryption

Question

Hello,

I want to create a storage account and enable infrastructure encryption. From MS documentation is states that: "Infrastructure-level encryption **relies on Microsoft-managed keys and always uses a separate key.**" https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption

My question is: if I Microsoft-managed keys by default for server side encryption and also infrastructure encryption, will MS store these 2 keys in 2 different Microsoft key stores?

Regards,
Angela

Answer 1

@Angela Calborean Yes absolutely, Customers who require high levels of assurance that their data is secure can also enable 256-bit AES encryption at the Azure Storage infrastructure level. When infrastructure encryption is enabled, data in a storage account is encrypted twice — once at the service level and once at the infrastructure level — with two different encryption algorithms and two different keys. Location is taken in the backend by Microsoft . Double encryption of Azure Storage data protects against a scenario where one of the encryption algorithms or keys may be compromised. In this scenario, the additional layer of encryption continues to protect your data.

Service-level encryption supports the use of either Microsoft-managed keys or customer-managed keys with Azure Key Vault. Infrastructure-level encryption relies on Microsoft-managed keys and always uses a separate key.

Please let us know if you have any further queries. I’m happy to assist you further.

----------

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.