{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-050-authorize-the-customer-s-local-application-identity-for-cross-tenant-disk-keys/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-050-authorize-the-customer-s-local-application-identity-for-cross-tenant-disk-keys/",
        "slug": "dse-20260909-050-authorize-the-customer-s-local-application-identity-for-cross-tenant-disk-keys",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-050-authorize-the-customer-s-local-application-identity-for-cross-tenant-disk-keys/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-050-authorize-the-customer-s-local-application-identity-for-cross-tenant-disk-keys.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-050-authorize-the-customer-s-local-application-identity-for-cross-tenant-disk-keys/"
        },
        "title": "Authorize the customer's local application identity for cross-tenant disk keys",
        "summary": "Which identity must receive access when an Azure disk encryption set uses a key in another tenant?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "identity-cloud",
            "label": "Identity & cloud",
            "alt": "Governed cloud identity system with connected service and lifecycle nodes.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:31:06+00:00",
        "modified_at": "2026-09-10T00:32:01+00:00",
        "reviewed_on": "2026-09-09",
        "reading_minutes": 2,
        "word_count": 251,
        "potentially_affected": "Service providers and customers configuring Azure managed disks with customer-managed keys held in a different Microsoft Entra tenant.",
        "dse_recommendation": "Reconcile the application client ID and the customer's service-principal object ID before granting key access.",
        "primary_source": {
            "name": "Use a disk encryption set across Microsoft Entra tenants - Azure Virtual Machines | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/disks-cross-tenant-customer-managed-keys",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft&#8217;s cross-tenant disk-key design combines a provider&#8217;s multitenant application and federated user-assigned identity with a customer-side service principal and key vault. Installing the application preserves its client ID but creates a different object ID for the customer&#8217;s service principal. Key access must use the vault&#8217;s active authorization mechanism. The managed disks and customer key vault must share an Azure region, although subscriptions may differ. <a href=\"https://learn.microsoft.com/en-us/azure/virtual-machines/disks-cross-tenant-customer-managed-keys\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Use this check when the disk resource and encryption key belong to different Microsoft Entra tenants. Identify both tenants, the provider&#8217;s disk encryption set and identity, and the customer&#8217;s installed application instance. Confirm regional and disk-type availability before preparing the authorization exchange.</p>\n<h2>DSE recommendation</h2>\n<p>Reconcile the application client ID and the customer&#8217;s service-principal object ID before granting key access. Have the customer verify the installed application against the provider&#8217;s approved registration, then select its local identity for the applicable vault permission. Exchange identifiers and the approved key location through the agreed channel; do not substitute the provider application&#8217;s object ID merely because its display name matches.</p>\n<h2>Verification</h2>\n<p>Inspect the resulting customer-side permission and the provider&#8217;s disk-encryption-set configuration together. In an approved test, confirm that the intended disk can use the customer-held key without broadening access to unrelated identities. Retain the two-tenant identifier mapping, authorization scope, and test outcome without key material or tokens. Resolve a mismatch at the identity or permission boundary before investigating the encryption setting itself.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/virtual-machines/disks-cross-tenant-customer-managed-keys\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Encrypt managed disks with cross-tenant customer-managed keys</a>. Source reviewed September 9, 2026.</p>",
        "content_text": "Source facts\nMicrosoft’s cross-tenant disk-key design combines a provider’s multitenant application and federated user-assigned identity with a customer-side service principal and key vault. Installing the application preserves its client ID but creates a different object ID for the customer’s service principal. Key access must use the vault’s active authorization mechanism. The managed disks and customer key vault must share an Azure region, although subscriptions may differ. Microsoft Learn.\nApplicability\nUse this check when the disk resource and encryption key belong to different Microsoft Entra tenants. Identify both tenants, the provider’s disk encryption set and identity, and the customer’s installed application instance. Confirm regional and disk-type availability before preparing the authorization exchange.\nDSE recommendation\nReconcile the application client ID and the customer’s service-principal object ID before granting key access. Have the customer verify the installed application against the provider’s approved registration, then select its local identity for the applicable vault permission. Exchange identifiers and the approved key location through the agreed channel; do not substitute the provider application’s object ID merely because its display name matches.\nVerification\nInspect the resulting customer-side permission and the provider’s disk-encryption-set configuration together. In an approved test, confirm that the intended disk can use the customer-held key without broadening access to unrelated identities. Retain the two-tenant identifier mapping, authorization scope, and test outcome without key material or tokens. Resolve a mismatch at the identity or permission boundary before investigating the encryption setting itself.\nOfficial references\nMicrosoft Learn: Encrypt managed disks with cross-tenant customer-managed keys. Source reviewed September 9, 2026.",
        "content_markdown": "## Source facts\n\nMicrosoft’s cross-tenant disk-key design combines a provider’s multitenant application and federated user-assigned identity with a customer-side service principal and key vault. Installing the application preserves its client ID but creates a different object ID for the customer’s service principal. Key access must use the vault’s active authorization mechanism. The managed disks and customer key vault must share an Azure region, although subscriptions may differ. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/disks-cross-tenant-customer-managed-keys).\n\n## Applicability\n\nUse this check when the disk resource and encryption key belong to different Microsoft Entra tenants. Identify both tenants, the provider’s disk encryption set and identity, and the customer’s installed application instance. Confirm regional and disk-type availability before preparing the authorization exchange.\n\n## DSE recommendation\n\nReconcile the application client ID and the customer’s service-principal object ID before granting key access. Have the customer verify the installed application against the provider’s approved registration, then select its local identity for the applicable vault permission. Exchange identifiers and the approved key location through the agreed channel; do not substitute the provider application’s object ID merely because its display name matches.\n\n## Verification\n\nInspect the resulting customer-side permission and the provider’s disk-encryption-set configuration together. In an approved test, confirm that the intended disk can use the customer-held key without broadening access to unrelated identities. Retain the two-tenant identifier mapping, authorization scope, and test outcome without key material or tokens. Resolve a mismatch at the identity or permission boundary before investigating the encryption setting itself.\n\n## Official references\n\n[Microsoft Learn: Encrypt managed disks with cross-tenant customer-managed keys](https://learn.microsoft.com/en-us/azure/virtual-machines/disks-cross-tenant-customer-managed-keys). Source reviewed September 9, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-050-authorize-the-customer-s-local-application-identity-for-cross-tenant-disk-keys/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-050-authorize-the-customer-s-local-application-identity-for-cross-tenant-disk-keys/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-09"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-050-authorize-the-customer-s-local-application-identity-for-cross-tenant-disk-keys/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Authorize the customer's local application identity for cross-tenant disk keys",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-050-authorize-the-customer-s-local-application-identity-for-cross-tenant-disk-keys/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-050-authorize-the-customer-s-local-application-identity-for-cross-tenant-disk-keys/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-050-authorize-the-customer-s-local-application-identity-for-cross-tenant-disk-keys/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-050-authorize-the-customer-s-local-application-identity-for-cross-tenant-disk-keys/",
                "headline": "Authorize the customer's local application identity for cross-tenant disk keys",
                "description": "Which identity must receive access when an Azure disk encryption set uses a key in another tenant?",
                "abstract": "Which identity must receive access when an Azure disk encryption set uses a key in another tenant?",
                "articleBody": "Source facts\nMicrosoft’s cross-tenant disk-key design combines a provider’s multitenant application and federated user-assigned identity with a customer-side service principal and key vault. Installing the application preserves its client ID but creates a different object ID for the customer’s service principal. Key access must use the vault’s active authorization mechanism. The managed disks and customer key vault must share an Azure region, although subscriptions may differ. Microsoft Learn.\nApplicability\nUse this check when the disk resource and encryption key belong to different Microsoft Entra tenants. Identify both tenants, the provider’s disk encryption set and identity, and the customer’s installed application instance. Confirm regional and disk-type availability before preparing the authorization exchange.\nDSE recommendation\nReconcile the application client ID and the customer’s service-principal object ID before granting key access. Have the customer verify the installed application against the provider’s approved registration, then select its local identity for the applicable vault permission. Exchange identifiers and the approved key location through the agreed channel; do not substitute the provider application’s object ID merely because its display name matches.\nVerification\nInspect the resulting customer-side permission and the provider’s disk-encryption-set configuration together. In an approved test, confirm that the intended disk can use the customer-held key without broadening access to unrelated identities. Retain the two-tenant identifier mapping, authorization scope, and test outcome without key material or tokens. Resolve a mismatch at the identity or permission boundary before investigating the encryption setting itself.\nOfficial references\nMicrosoft Learn: Encrypt managed disks with cross-tenant customer-managed keys. Source reviewed September 9, 2026.",
                "datePublished": "2026-09-10T00:31:06+00:00",
                "dateModified": "2026-09-10T00:32:01+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-050-authorize-the-customer-s-local-application-identity-for-cross-tenant-disk-keys/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-050-authorize-the-customer-s-local-application-identity-for-cross-tenant-disk-keys/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Authorize the customer's local application identity for cross-tenant disk keys"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 251,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Use a disk encryption set across Microsoft Entra tenants - Azure Virtual Machines | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/disks-cross-tenant-customer-managed-keys"
                }
            }
        ]
    }
}