{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-042-check-where-a-saved-log-analytics-query-lives-before-claiming-customer-key/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-042-check-where-a-saved-log-analytics-query-lives-before-claiming-customer-key/", "slug": "dse-20260917-042-check-where-a-saved-log-analytics-query-lives-before-claiming-customer-key", "url": "https://update.dsesecurity.com/updates/dse-20260917-042-check-where-a-saved-log-analytics-query-lives-before-claiming-customer-key/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-042-check-where-a-saved-log-analytics-query-lives-before-claiming-customer-key.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-042-check-where-a-saved-log-analytics-query-lives-before-claiming-customer-key/" }, "title": "Check where a saved Log Analytics query lives before claiming customer-key protection", "summary": "Distinguish query packs from the linked-storage route for customer-managed encryption.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:18+00:00", "modified_at": "2026-09-17T16:35:04+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 210, "potentially_affected": "Use this review when a monitoring team has a specific requirement to protect saved query text through a customer-managed key. Identify the actual save location, workspace, linked account and encryption configuration. A cluster encryption setting alone is insufficient evidence about where a particular saved query resides.", "dse_recommendation": "DSE recommends classifying representative saved queries by storage location before selecting the configuration.", "primary_source": { "name": "Azure Monitor Customer-Managed Keys - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/customer-managed-keys", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft states that queries saved in a query pack are not stored in the linked storage account and cannot use its customer-managed encryption. The guide recommends saving a legacy query for that protection. The linked account must be StorageV2, share the workspace region, and itself be configured with a customer-managed key. Microsoft Learn.

\n

Applicability

\n

Use this review when a monitoring team has a specific requirement to protect saved query text through a customer-managed key. Identify the actual save location, workspace, linked account and encryption configuration. A cluster encryption setting alone is insufficient evidence about where a particular saved query resides.

\n

DSE recommendation

\n

DSE recommends classifying representative saved queries by storage location before selecting the configuration. Have the monitoring and key owners agree which query artifacts require this protection. Review the source’s migration considerations before changing a workspace link, including its instructions to copy existing saved queries and functions beforehand.

\n

Verification

\n

Save a harmless representative query through the intended documented path and inspect its location alongside the linked account’s encryption settings. Record the account type, region and key reference without exposing sensitive query text. Keep query-pack artifacts outside a successful protection claim unless a separate supported approach is established.

\n

Official references

\n

Microsoft Learn: Azure Monitor Customer-Managed Keys.

", "content_text": "Source facts\nMicrosoft states that queries saved in a query pack are not stored in the linked storage account and cannot use its customer-managed encryption. The guide recommends saving a legacy query for that protection. The linked account must be StorageV2, share the workspace region, and itself be configured with a customer-managed key. Microsoft Learn.\nApplicability\nUse this review when a monitoring team has a specific requirement to protect saved query text through a customer-managed key. Identify the actual save location, workspace, linked account and encryption configuration. A cluster encryption setting alone is insufficient evidence about where a particular saved query resides.\nDSE recommendation\nDSE recommends classifying representative saved queries by storage location before selecting the configuration. Have the monitoring and key owners agree which query artifacts require this protection. Review the source’s migration considerations before changing a workspace link, including its instructions to copy existing saved queries and functions beforehand.\nVerification\nSave a harmless representative query through the intended documented path and inspect its location alongside the linked account’s encryption settings. Record the account type, region and key reference without exposing sensitive query text. Keep query-pack artifacts outside a successful protection claim unless a separate supported approach is established.\nOfficial references\nMicrosoft Learn: Azure Monitor Customer-Managed Keys.", "content_markdown": "## Source facts\n\nMicrosoft states that queries saved in a query pack are not stored in the linked storage account and cannot use its customer-managed encryption. The guide recommends saving a legacy query for that protection. The linked account must be StorageV2, share the workspace region, and itself be configured with a customer-managed key. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/customer-managed-keys).\n\n## Applicability\n\nUse this review when a monitoring team has a specific requirement to protect saved query text through a customer-managed key. Identify the actual save location, workspace, linked account and encryption configuration. A cluster encryption setting alone is insufficient evidence about where a particular saved query resides.\n\n## DSE recommendation\n\nDSE recommends classifying representative saved queries by storage location before selecting the configuration. Have the monitoring and key owners agree which query artifacts require this protection. Review the source’s migration considerations before changing a workspace link, including its instructions to copy existing saved queries and functions beforehand.\n\n## Verification\n\nSave a harmless representative query through the intended documented path and inspect its location alongside the linked account’s encryption settings. Record the account type, region and key reference without exposing sensitive query text. Keep query-pack artifacts outside a successful protection claim unless a separate supported approach is established.\n\n## Official references\n\n[Microsoft Learn: Azure Monitor Customer-Managed Keys](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/customer-managed-keys)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-042-check-where-a-saved-log-analytics-query-lives-before-claiming-customer-key/", "url": "https://update.dsesecurity.com/updates/dse-20260917-042-check-where-a-saved-log-analytics-query-lives-before-claiming-customer-key/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-042-check-where-a-saved-log-analytics-query-lives-before-claiming-customer-key/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check where a saved Log Analytics query lives before claiming customer-key protection", "item": "https://update.dsesecurity.com/updates/dse-20260917-042-check-where-a-saved-log-analytics-query-lives-before-claiming-customer-key/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-042-check-where-a-saved-log-analytics-query-lives-before-claiming-customer-key/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-042-check-where-a-saved-log-analytics-query-lives-before-claiming-customer-key/", "url": "https://update.dsesecurity.com/updates/dse-20260917-042-check-where-a-saved-log-analytics-query-lives-before-claiming-customer-key/", "headline": "Check where a saved Log Analytics query lives before claiming customer-key protection", "description": "Distinguish query packs from the linked-storage route for customer-managed encryption.", "abstract": "Distinguish query packs from the linked-storage route for customer-managed encryption.", "articleBody": "Source facts\nMicrosoft states that queries saved in a query pack are not stored in the linked storage account and cannot use its customer-managed encryption. The guide recommends saving a legacy query for that protection. The linked account must be StorageV2, share the workspace region, and itself be configured with a customer-managed key. Microsoft Learn.\nApplicability\nUse this review when a monitoring team has a specific requirement to protect saved query text through a customer-managed key. Identify the actual save location, workspace, linked account and encryption configuration. A cluster encryption setting alone is insufficient evidence about where a particular saved query resides.\nDSE recommendation\nDSE recommends classifying representative saved queries by storage location before selecting the configuration. Have the monitoring and key owners agree which query artifacts require this protection. Review the source’s migration considerations before changing a workspace link, including its instructions to copy existing saved queries and functions beforehand.\nVerification\nSave a harmless representative query through the intended documented path and inspect its location alongside the linked account’s encryption settings. Record the account type, region and key reference without exposing sensitive query text. Keep query-pack artifacts outside a successful protection claim unless a separate supported approach is established.\nOfficial references\nMicrosoft Learn: Azure Monitor Customer-Managed Keys.", "datePublished": "2026-09-17T16:34:18+00:00", "dateModified": "2026-09-17T16:35:04+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-042-check-where-a-saved-log-analytics-query-lives-before-claiming-customer-key/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-042-check-where-a-saved-log-analytics-query-lives-before-claiming-customer-key/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check where a saved Log Analytics query lives before claiming customer-key protection" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 210, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Azure Monitor Customer-Managed Keys - Azure Monitor | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/customer-managed-keys" } } ] } }