{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-472-check-backup-vault-lifecycle-constraints-before-enabling-customer-managed/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-472-check-backup-vault-lifecycle-constraints-before-enabling-customer-managed/",
        "slug": "dse-20260909-472-check-backup-vault-lifecycle-constraints-before-enabling-customer-managed",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-472-check-backup-vault-lifecycle-constraints-before-enabling-customer-managed/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-472-check-backup-vault-lifecycle-constraints-before-enabling-customer-managed.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-472-check-backup-vault-lifecycle-constraints-before-enabling-customer-managed/"
        },
        "title": "Check Backup vault lifecycle constraints before enabling customer-managed encryption",
        "summary": "The CMK decision affects return to platform keys, supported tiers, and future resource moves.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "continuity-recovery",
            "label": "Continuity & recovery",
            "alt": "Paired infrastructure paths converging on a stable recovered service.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:24:04+00:00",
        "modified_at": "2026-09-10T02:08:05+00:00",
        "reviewed_on": "2026-09-09",
        "reading_minutes": 2,
        "word_count": 235,
        "potentially_affected": "Azure Backup vaults being considered for customer-managed key encryption.",
        "dse_recommendation": "Approve the continuing key dependency and vault-movement constraints before enabling CMK encryption.",
        "primary_source": {
            "name": "Encrypt backup data in a Backup vault by using customer-managed keys - Azure Backup | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/backup/encryption-at-rest-with-cmk-for-backup-vault",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>After customer-managed encryption is enabled for a Backup vault, Microsoft does not allow a return to platform-managed keys. Encryption keys or the managed identity can still be changed.</p>\n<p>Moving that CMK-encrypted vault across resource groups or subscriptions is unsupported. CMK covers the vault and vault-archive tiers, not the operational tier. If access to the required key is lost and cannot be restored, the stored backup data becomes inaccessible. <a href=\"https://learn.microsoft.com/en-us/azure/backup/encryption-at-rest-with-cmk-for-backup-vault\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Confirm that the resource is a Backup vault, identify the protection tiers in use, and review planned resource-group or subscription changes. Assess the full key, identity, permission, and network requirements before selecting the encryption model; this article does not prescribe CMK for every workload.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends documenting the decision as an ongoing dependency rather than a temporary encryption toggle. Have the backup and key owners approve lifecycle responsibility and the effect on planned moves. Require a specific explanation of the protection scope so operational-tier coverage is not inferred from the vault setting.</p>\n<h2>Verification</h2>\n<p>Before production enablement, test the approved configuration with representative backup and restore operations in a suitable environment. Check the recorded resource type, tier, key identity, and authorized recovery procedure. Review the migration plan against the documented restrictions rather than attempting a disruptive move to discover whether it is supported.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/backup/encryption-at-rest-with-cmk-for-backup-vault\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Encrypt backup data in a Backup vault by using customer-managed keys</a>. Source retrieved September 9, 2026.</p>",
        "content_text": "Source facts\nAfter customer-managed encryption is enabled for a Backup vault, Microsoft does not allow a return to platform-managed keys. Encryption keys or the managed identity can still be changed.\nMoving that CMK-encrypted vault across resource groups or subscriptions is unsupported. CMK covers the vault and vault-archive tiers, not the operational tier. If access to the required key is lost and cannot be restored, the stored backup data becomes inaccessible. Microsoft Learn.\nApplicability\nConfirm that the resource is a Backup vault, identify the protection tiers in use, and review planned resource-group or subscription changes. Assess the full key, identity, permission, and network requirements before selecting the encryption model; this article does not prescribe CMK for every workload.\nDSE recommendation\nDSE recommends documenting the decision as an ongoing dependency rather than a temporary encryption toggle. Have the backup and key owners approve lifecycle responsibility and the effect on planned moves. Require a specific explanation of the protection scope so operational-tier coverage is not inferred from the vault setting.\nVerification\nBefore production enablement, test the approved configuration with representative backup and restore operations in a suitable environment. Check the recorded resource type, tier, key identity, and authorized recovery procedure. Review the migration plan against the documented restrictions rather than attempting a disruptive move to discover whether it is supported.\nOfficial references\nMicrosoft Learn: Encrypt backup data in a Backup vault by using customer-managed keys. Source retrieved September 9, 2026.",
        "content_markdown": "## Source facts\n\nAfter customer-managed encryption is enabled for a Backup vault, Microsoft does not allow a return to platform-managed keys. Encryption keys or the managed identity can still be changed.\n\nMoving that CMK-encrypted vault across resource groups or subscriptions is unsupported. CMK covers the vault and vault-archive tiers, not the operational tier. If access to the required key is lost and cannot be restored, the stored backup data becomes inaccessible. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/backup/encryption-at-rest-with-cmk-for-backup-vault).\n\n## Applicability\n\nConfirm that the resource is a Backup vault, identify the protection tiers in use, and review planned resource-group or subscription changes. Assess the full key, identity, permission, and network requirements before selecting the encryption model; this article does not prescribe CMK for every workload.\n\n## DSE recommendation\n\nDSE recommends documenting the decision as an ongoing dependency rather than a temporary encryption toggle. Have the backup and key owners approve lifecycle responsibility and the effect on planned moves. Require a specific explanation of the protection scope so operational-tier coverage is not inferred from the vault setting.\n\n## Verification\n\nBefore production enablement, test the approved configuration with representative backup and restore operations in a suitable environment. Check the recorded resource type, tier, key identity, and authorized recovery procedure. Review the migration plan against the documented restrictions rather than attempting a disruptive move to discover whether it is supported.\n\n## Official references\n\n[Microsoft Learn: Encrypt backup data in a Backup vault by using customer-managed keys](https://learn.microsoft.com/en-us/azure/backup/encryption-at-rest-with-cmk-for-backup-vault). Source retrieved September 9, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-472-check-backup-vault-lifecycle-constraints-before-enabling-customer-managed/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-472-check-backup-vault-lifecycle-constraints-before-enabling-customer-managed/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-09"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-472-check-backup-vault-lifecycle-constraints-before-enabling-customer-managed/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Check Backup vault lifecycle constraints before enabling customer-managed encryption",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-472-check-backup-vault-lifecycle-constraints-before-enabling-customer-managed/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-472-check-backup-vault-lifecycle-constraints-before-enabling-customer-managed/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-472-check-backup-vault-lifecycle-constraints-before-enabling-customer-managed/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-472-check-backup-vault-lifecycle-constraints-before-enabling-customer-managed/",
                "headline": "Check Backup vault lifecycle constraints before enabling customer-managed encryption",
                "description": "The CMK decision affects return to platform keys, supported tiers, and future resource moves.",
                "abstract": "The CMK decision affects return to platform keys, supported tiers, and future resource moves.",
                "articleBody": "Source facts\nAfter customer-managed encryption is enabled for a Backup vault, Microsoft does not allow a return to platform-managed keys. Encryption keys or the managed identity can still be changed.\nMoving that CMK-encrypted vault across resource groups or subscriptions is unsupported. CMK covers the vault and vault-archive tiers, not the operational tier. If access to the required key is lost and cannot be restored, the stored backup data becomes inaccessible. Microsoft Learn.\nApplicability\nConfirm that the resource is a Backup vault, identify the protection tiers in use, and review planned resource-group or subscription changes. Assess the full key, identity, permission, and network requirements before selecting the encryption model; this article does not prescribe CMK for every workload.\nDSE recommendation\nDSE recommends documenting the decision as an ongoing dependency rather than a temporary encryption toggle. Have the backup and key owners approve lifecycle responsibility and the effect on planned moves. Require a specific explanation of the protection scope so operational-tier coverage is not inferred from the vault setting.\nVerification\nBefore production enablement, test the approved configuration with representative backup and restore operations in a suitable environment. Check the recorded resource type, tier, key identity, and authorized recovery procedure. Review the migration plan against the documented restrictions rather than attempting a disruptive move to discover whether it is supported.\nOfficial references\nMicrosoft Learn: Encrypt backup data in a Backup vault by using customer-managed keys. Source retrieved September 9, 2026.",
                "datePublished": "2026-09-10T00:24:04+00:00",
                "dateModified": "2026-09-10T02:08:05+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-472-check-backup-vault-lifecycle-constraints-before-enabling-customer-managed/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-472-check-backup-vault-lifecycle-constraints-before-enabling-customer-managed/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Check Backup vault lifecycle constraints before enabling customer-managed encryption"
                },
                "articleSection": [
                    "Business Continuity",
                    "IT"
                ],
                "keywords": [
                    "Business Continuity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 235,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Encrypt backup data in a Backup vault by using customer-managed keys - Azure Backup | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/backup/encryption-at-rest-with-cmk-for-backup-vault"
                }
            }
        ]
    }
}