Ensure the storage account storing activity logs is encrypted with Customer Managed Key (CMK)

Overview

Storage accounts with the activity log exports can be configured to use Customer Managed Keys (CMK).

Rationale

Configuring the storage account with the activity log export container to use CMKs provides additional confidentiality controls on log data. A given user must have read permission on the corresponding storage account and must be granted decryption permission by the CMK.

Impact

NOTE: You must have your key vault setup to utilize this.

All Audit Logs will be encrypted with a key you provide. You will need to set up customer-managed keys separately, and you will select which key to use via the instructions here. You will be responsible for the keys' lifecycle and will need to manually replace them at your own determined intervals to keep the data secure.

Default Value

By default, storage accounts are encrypted with keys managed by Microsoft.

Remediation guidance

Remediate from Azure Portal

Go to Monitor.
Select Activity log.
Select Export Activity Logs.
Select a Subscription.
Note the name of the Storage Account for the diagnostic setting.
Navigate to Storage accounts.
Click on the storage account.
Under Security + networking, click Encryption.
Next to Encryption type, select Customer-managed keys.
Complete the steps to configure a customer-managed key for encryption of the storage account.

Remediate from Azure CLI

az storage account update --name <name of the storage account> --resource-group <resource group for a storage account> --encryption-key-source=Microsoft.Keyvault --encryption-key-vault  --encryption-key-name  --encryption-key-version

Remediate from PowerShell

Set-AzStorageAccount -ResourceGroupName <resourceGroupName> -Name <storageAccountName> -KeyvaultEncryption -KeyVaultUri  -KeyName

Multiple Remediation Paths

Azure

SERVICE-WIDE (RECOMMENDED when many resources are affected): Assign Azure Policy initiatives at management group/subscription scope and trigger remediation tasks.

az policy assignment create --name <assignment-name> --scope /subscriptions/<subscription-id> --policy-set-definition <initiative-id>
az policy remediation create --name <remediation-name> --policy-assignment <assignment-id>

ASSET-LEVEL: Apply the resource-specific remediation steps above to the listed non-compliant resources.

PREVENTIVE: Embed Azure Policy checks into landing zones and IaC workflows to block or auto-remediate drift.

References for Service-Wide Patterns

Azure Policy overview: https://learn.microsoft.com/en-us/azure/governance/policy/overview
Azure Policy remediation: https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources
Azure Policy initiative structure: https://learn.microsoft.com/en-us/azure/governance/policy/concepts/initiative-definition-structure

Operational Rollout Workflow

Use this sequence to reduce risk and avoid repeated drift.

1. Contain at Service-Wide Scope First (Recommended)

Azure: assign policy initiatives at management group/subscription scope and run remediation tasks.

az policy assignment create --name <assignment-name> --scope /subscriptions/<subscription-id> --policy-set-definition <initiative-id>
az policy remediation create --name <remediation-name> --policy-assignment <assignment-id>

2. Remediate Existing Affected Assets

Execute the control-specific Console/CLI steps documented above for each flagged resource.
Prioritize internet-exposed and production assets first.

3. Validate and Prevent Recurrence

Re-scan after each remediation batch.
Track exceptions with owner and expiry date.
Add preventive checks in IaC/CI pipelines.

Query logic

These are the stored checks tied to this control.

Azure Subscription Diagnostic Settings Without CMK

Connectors

Microsoft Azure

Covered asset types

StorageAccount

Expected check: eq []

{
  storageAccounts(
    where: {
      NOT: { destinationForSubscriptionDiagnosticSettings_SOME: null }
      byokEncrypted: false
    }
  ) {
    ...AssetFragment
  }
}