{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-213-map-both-identities-in-the-managed-application-storage-encryption-recipe/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-213-map-both-identities-in-the-managed-application-storage-encryption-recipe/", "slug": "dse-20260909-213-map-both-identities-in-the-managed-application-storage-encryption-recipe", "url": "https://update.dsesecurity.com/updates/dse-20260909-213-map-both-identities-in-the-managed-application-storage-encryption-recipe/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-213-map-both-identities-in-the-managed-application-storage-encryption-recipe.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-213-map-both-identities-in-the-managed-application-storage-encryption-recipe/" }, "title": "Map both identities in the managed-application storage encryption recipe", "summary": "Which grant connects a managed application's identity to the separate identity that can use its storage encryption key?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:28:23+00:00", "modified_at": "2026-09-10T01:20:45+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 232, "potentially_affected": "The documented preview user-assigned identity path for a managed application deploying CMK-encrypted storage from an existing key vault.", "dse_recommendation": "DSE recommends drawing the two identity-to-resource grants explicitly before approving this deployment.", "primary_source": { "name": "Create Azure Managed Application that deploys storage account encrypted with customer-managed key - Azure Managed Applications | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/create-storage-customer-managed-key", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For storage deployed in a managed application’s resource group with a customer-managed key, Microsoft’s recipe requires a user-assigned identity. The managed application’s identity needs Managed Identity Operator on the separate identity that accesses the existing key vault. The example gives that key-access identity the Key Vault Crypto Service Encryption User role on the vault. The documented user-assigned identity interface is labeled preview. Microsoft Learn.

\n

Applicability

\n

Keep this review within the documented preview identity-integration path. Distinguish the managed application’s principal from the principal that uses the key. Do not substitute the deployment operator’s own vault access for either runtime identity or assume that a shared display name makes them equivalent.

\n

DSE recommendation

\n

DSE recommends drawing the two identity-to-resource grants explicitly before approving this deployment. Record the application identity, key-access identity, vault and key identifiers, and the scope of each approved role. Have both the application and key owners confirm the relationship. Review the source’s remaining vault and deployment prerequisites separately; this grant map does not replace that preparation.

\n

Verification

\n

In a controlled deployment, inspect the identity assigned to the managed application and the identity selected in the storage account’s encryption configuration. Compare their actual role assignments with the approved map, then exercise an authorized storage operation. Keep only identifiers and permission evidence, never key values. Resolve any mismatched principal or scope before broader rollout.

\n

Official references

\n

Microsoft Learn. Source retrieved September 9, 2026.

", "content_text": "Source facts\nFor storage deployed in a managed application’s resource group with a customer-managed key, Microsoft’s recipe requires a user-assigned identity. The managed application’s identity needs Managed Identity Operator on the separate identity that accesses the existing key vault. The example gives that key-access identity the Key Vault Crypto Service Encryption User role on the vault. The documented user-assigned identity interface is labeled preview. Microsoft Learn.\nApplicability\nKeep this review within the documented preview identity-integration path. Distinguish the managed application’s principal from the principal that uses the key. Do not substitute the deployment operator’s own vault access for either runtime identity or assume that a shared display name makes them equivalent.\nDSE recommendation\nDSE recommends drawing the two identity-to-resource grants explicitly before approving this deployment. Record the application identity, key-access identity, vault and key identifiers, and the scope of each approved role. Have both the application and key owners confirm the relationship. Review the source’s remaining vault and deployment prerequisites separately; this grant map does not replace that preparation.\nVerification\nIn a controlled deployment, inspect the identity assigned to the managed application and the identity selected in the storage account’s encryption configuration. Compare their actual role assignments with the approved map, then exercise an authorized storage operation. Keep only identifiers and permission evidence, never key values. Resolve any mismatched principal or scope before broader rollout.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nFor storage deployed in a managed application’s resource group with a customer-managed key, Microsoft’s recipe requires a user-assigned identity. The managed application’s identity needs Managed Identity Operator on the separate identity that accesses the existing key vault. The example gives that key-access identity the Key Vault Crypto Service Encryption User role on the vault. The documented user-assigned identity interface is labeled preview. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/create-storage-customer-managed-key).\n\n## Applicability\n\nKeep this review within the documented preview identity-integration path. Distinguish the managed application’s principal from the principal that uses the key. Do not substitute the deployment operator’s own vault access for either runtime identity or assume that a shared display name makes them equivalent.\n\n## DSE recommendation\n\nDSE recommends drawing the two identity-to-resource grants explicitly before approving this deployment. Record the application identity, key-access identity, vault and key identifiers, and the scope of each approved role. Have both the application and key owners confirm the relationship. Review the source’s remaining vault and deployment prerequisites separately; this grant map does not replace that preparation.\n\n## Verification\n\nIn a controlled deployment, inspect the identity assigned to the managed application and the identity selected in the storage account’s encryption configuration. Compare their actual role assignments with the approved map, then exercise an authorized storage operation. Keep only identifiers and permission evidence, never key values. Resolve any mismatched principal or scope before broader rollout.\n\n## Official references\n\n[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/create-storage-customer-managed-key). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-213-map-both-identities-in-the-managed-application-storage-encryption-recipe/", "url": "https://update.dsesecurity.com/updates/dse-20260909-213-map-both-identities-in-the-managed-application-storage-encryption-recipe/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-213-map-both-identities-in-the-managed-application-storage-encryption-recipe/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Map both identities in the managed-application storage encryption recipe", "item": "https://update.dsesecurity.com/updates/dse-20260909-213-map-both-identities-in-the-managed-application-storage-encryption-recipe/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-213-map-both-identities-in-the-managed-application-storage-encryption-recipe/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-213-map-both-identities-in-the-managed-application-storage-encryption-recipe/", "url": "https://update.dsesecurity.com/updates/dse-20260909-213-map-both-identities-in-the-managed-application-storage-encryption-recipe/", "headline": "Map both identities in the managed-application storage encryption recipe", "description": "Which grant connects a managed application's identity to the separate identity that can use its storage encryption key?", "abstract": "Which grant connects a managed application's identity to the separate identity that can use its storage encryption key?", "articleBody": "Source facts\nFor storage deployed in a managed application’s resource group with a customer-managed key, Microsoft’s recipe requires a user-assigned identity. The managed application’s identity needs Managed Identity Operator on the separate identity that accesses the existing key vault. The example gives that key-access identity the Key Vault Crypto Service Encryption User role on the vault. The documented user-assigned identity interface is labeled preview. Microsoft Learn.\nApplicability\nKeep this review within the documented preview identity-integration path. Distinguish the managed application’s principal from the principal that uses the key. Do not substitute the deployment operator’s own vault access for either runtime identity or assume that a shared display name makes them equivalent.\nDSE recommendation\nDSE recommends drawing the two identity-to-resource grants explicitly before approving this deployment. Record the application identity, key-access identity, vault and key identifiers, and the scope of each approved role. Have both the application and key owners confirm the relationship. Review the source’s remaining vault and deployment prerequisites separately; this grant map does not replace that preparation.\nVerification\nIn a controlled deployment, inspect the identity assigned to the managed application and the identity selected in the storage account’s encryption configuration. Compare their actual role assignments with the approved map, then exercise an authorized storage operation. Keep only identifiers and permission evidence, never key values. Resolve any mismatched principal or scope before broader rollout.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:28:23+00:00", "dateModified": "2026-09-10T01:20:45+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-213-map-both-identities-in-the-managed-application-storage-encryption-recipe/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-213-map-both-identities-in-the-managed-application-storage-encryption-recipe/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Map both identities in the managed-application storage encryption recipe" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 232, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create Azure Managed Application that deploys storage account encrypted with customer-managed key - Azure Managed Applications | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/create-storage-customer-managed-key" } } ] } }