| Plugin Title | Blob Service Encryption |
| Cloud | AZURE |
| Category | Storage Accounts |
| Description | Ensures encryption is properly configured for Blob Services |
| More Info | Blob Services can be configured to encrypt data-at-rest. By default Azure will create a set of keys to encrypt Blob Services, but the recommended approach is to create your own keys using Azure Key Vault. |
| AZURE Link | https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption |
| Recommended Action | Ensure that Blob Service is configured to use a customer-provided key vault key. |
- Log into the Microsoft Azure Management Console.
- Select the "Search resources, services, and docs" option at the top and search for "Storage account."
- On the "Storage account" page, scroll down the left navigation panel and choose "Containers" under the "Blob services."
- Select the "Container" on the "Containers" page.
- Scroll down the "Storage account" navigation panel and choose "Encryption" option under the "Settings."
- On the "Encryption page" scroll down and check "Use your own key" setting configuration. If "Use your own key" setting checkbox is not checked, then "BYOK encryption" is not configured in the Blob Service Encryption.
- Repeat steps number 2 - 5 to verify other "Blob Service Encryption" in the Azure account.
- Navigate to "Storage account", select the corresponding "Storage account", scroll down the left navigation panel and choose "Encryption."
- On the "Encyption page" select the "Use your own key" and click on the "Select from Key Vault".
- On the "Key vault" option select the vault accordingly.
- On the "Encryption key" option select the key accordingly.
- Click on the "Save" option at the top to make the changes.
- Repeat steps number 8 - 12 to ensure the Storage Account used by Activity Logs is configured with a BYOK key.
