The grain-silo storage account still uses Microsoft-managed keys, and auditors want the canal authority to hold the encryption key. How do you configure Bring Your Own Key for Storage encryption?
Select an answer to reveal the explanation.
Short Explanation
Microsoft’s key is like the landlord’s master lock. BYOK means your Key Vault (or Managed HSM) holds the key, and the storage account’s managed identity is allowed to unwrap it—nothing more mystical than that.
Full Explanation
Storage service-side encryption can use Microsoft-managed keys or a customer-managed key (BYOK). For CMK, you reference a key in Azure Key Vault or Managed HSM and assign the storage account a managed identity with unwrap (and related) permissions so encryption continues under your key material. Access keys are account credentials, not SSE key custodianship, and encryption at rest should remain enabled.