{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-074-confirm-the-azure-files-resource-provider-before-applying-storage-account-cmk/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260917-074-confirm-the-azure-files-resource-provider-before-applying-storage-account-cmk/",
        "slug": "dse-20260917-074-confirm-the-azure-files-resource-provider-before-applying-storage-account-cmk",
        "url": "https://update.dsesecurity.com/updates/dse-20260917-074-confirm-the-azure-files-resource-provider-before-applying-storage-account-cmk/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260917-074-confirm-the-azure-files-resource-provider-before-applying-storage-account-cmk.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-074-confirm-the-azure-files-resource-provider-before-applying-storage-account-cmk/"
        },
        "title": "Confirm the Azure Files resource provider before applying storage-account CMK guidance",
        "summary": "DSE recommends capturing the share’s resource identifier and provider before preparing the key configuration.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "managed-it",
            "label": "Managed IT operations",
            "alt": "A controlled technology lifecycle progressing from assessment to approved production.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-17T16:33:46+00:00",
        "modified_at": "2026-09-17T16:38:45+00:00",
        "reviewed_on": "2026-09-17",
        "reading_minutes": 1,
        "word_count": 206,
        "potentially_affected": "This check is for an Azure Files encryption change where the team must first establish that the selected account and share match the documented procedure.",
        "dse_recommendation": "DSE recommends capturing the share’s resource identifier and provider before preparing the key configuration.",
        "primary_source": {
            "name": "Configure Customer-Managed Keys for Azure Files | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/storage/files/customer-managed-keys",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft limits this procedure to classic SMB and NFS shares created through Microsoft.Storage and excludes shares created through Microsoft.FileShares. For the covered storage account, Azure Files data uses the configured customer key without a separate opt-in for each share. The documented Key Vault setup requires purge protection. <a href=\"https://learn.microsoft.com/en-us/azure/storage/files/customer-managed-keys\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a></p>\n<h2>Applicability</h2>\n<p>This check is for an Azure Files encryption change where the team must first establish that the selected account and share match the documented procedure.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends capturing the share’s resource identifier and provider before preparing the key configuration. List the covered storage account, intended vault and key, responsible identity owner, and recovery controls in the change record. Have the storage and key owners agree the account-level scope before proceeding. Route a share from a different resource provider to its applicable guidance rather than carrying this procedure across by name alone.</p>\n<h2>Verification</h2>\n<p>Verify the resource provider and account encryption configuration against the approved scope. Confirm the selected vault’s protection settings and retain the observed key reference without exposing sensitive material. Test the agreed file-access scenario after the authorized change and record any unresolved access or configuration difference.</p>\n<h2>Official references</h2>\n<ul>\n<li><a href=\"https://learn.microsoft.com/en-us/azure/storage/files/customer-managed-keys\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft: Configure Customer-Managed Keys for Azure Files | Microsoft Learn</a></li>\n</ul>",
        "content_text": "Source facts\nMicrosoft limits this procedure to classic SMB and NFS shares created through Microsoft.Storage and excludes shares created through Microsoft.FileShares. For the covered storage account, Azure Files data uses the configured customer key without a separate opt-in for each share. The documented Key Vault setup requires purge protection. Microsoft Learn\nApplicability\nThis check is for an Azure Files encryption change where the team must first establish that the selected account and share match the documented procedure.\nDSE recommendation\nDSE recommends capturing the share’s resource identifier and provider before preparing the key configuration. List the covered storage account, intended vault and key, responsible identity owner, and recovery controls in the change record. Have the storage and key owners agree the account-level scope before proceeding. Route a share from a different resource provider to its applicable guidance rather than carrying this procedure across by name alone.\nVerification\nVerify the resource provider and account encryption configuration against the approved scope. Confirm the selected vault’s protection settings and retain the observed key reference without exposing sensitive material. Test the agreed file-access scenario after the authorized change and record any unresolved access or configuration difference.\nOfficial references\n\nMicrosoft: Configure Customer-Managed Keys for Azure Files | Microsoft Learn",
        "content_markdown": "## Source facts\n\nMicrosoft limits this procedure to classic SMB and NFS shares created through Microsoft.Storage and excludes shares created through Microsoft.FileShares. For the covered storage account, Azure Files data uses the configured customer key without a separate opt-in for each share. The documented Key Vault setup requires purge protection. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/files/customer-managed-keys)\n\n## Applicability\n\nThis check is for an Azure Files encryption change where the team must first establish that the selected account and share match the documented procedure.\n\n## DSE recommendation\n\nDSE recommends capturing the share’s resource identifier and provider before preparing the key configuration. List the covered storage account, intended vault and key, responsible identity owner, and recovery controls in the change record. Have the storage and key owners agree the account-level scope before proceeding. Route a share from a different resource provider to its applicable guidance rather than carrying this procedure across by name alone.\n\n## Verification\n\nVerify the resource provider and account encryption configuration against the approved scope. Confirm the selected vault’s protection settings and retain the observed key reference without exposing sensitive material. Test the agreed file-access scenario after the authorized change and record any unresolved access or configuration difference.\n\n## Official references\n\n- [Microsoft: Configure Customer-Managed Keys for Azure Files | Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/files/customer-managed-keys)"
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-074-confirm-the-azure-files-resource-provider-before-applying-storage-account-cmk/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-074-confirm-the-azure-files-resource-provider-before-applying-storage-account-cmk/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-17"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-074-confirm-the-azure-files-resource-provider-before-applying-storage-account-cmk/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Confirm the Azure Files resource provider before applying storage-account CMK guidance",
                        "item": "https://update.dsesecurity.com/updates/dse-20260917-074-confirm-the-azure-files-resource-provider-before-applying-storage-account-cmk/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-074-confirm-the-azure-files-resource-provider-before-applying-storage-account-cmk/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260917-074-confirm-the-azure-files-resource-provider-before-applying-storage-account-cmk/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-074-confirm-the-azure-files-resource-provider-before-applying-storage-account-cmk/",
                "headline": "Confirm the Azure Files resource provider before applying storage-account CMK guidance",
                "description": "DSE recommends capturing the share’s resource identifier and provider before preparing the key configuration.",
                "abstract": "DSE recommends capturing the share’s resource identifier and provider before preparing the key configuration.",
                "articleBody": "Source facts\nMicrosoft limits this procedure to classic SMB and NFS shares created through Microsoft.Storage and excludes shares created through Microsoft.FileShares. For the covered storage account, Azure Files data uses the configured customer key without a separate opt-in for each share. The documented Key Vault setup requires purge protection. Microsoft Learn\nApplicability\nThis check is for an Azure Files encryption change where the team must first establish that the selected account and share match the documented procedure.\nDSE recommendation\nDSE recommends capturing the share’s resource identifier and provider before preparing the key configuration. List the covered storage account, intended vault and key, responsible identity owner, and recovery controls in the change record. Have the storage and key owners agree the account-level scope before proceeding. Route a share from a different resource provider to its applicable guidance rather than carrying this procedure across by name alone.\nVerification\nVerify the resource provider and account encryption configuration against the approved scope. Confirm the selected vault’s protection settings and retain the observed key reference without exposing sensitive material. Test the agreed file-access scenario after the authorized change and record any unresolved access or configuration difference.\nOfficial references\n\nMicrosoft: Configure Customer-Managed Keys for Azure Files | Microsoft Learn",
                "datePublished": "2026-09-17T16:33:46+00:00",
                "dateModified": "2026-09-17T16:38:45+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-074-confirm-the-azure-files-resource-provider-before-applying-storage-account-cmk/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-074-confirm-the-azure-files-resource-provider-before-applying-storage-account-cmk/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Confirm the Azure Files resource provider before applying storage-account CMK guidance"
                },
                "articleSection": [
                    "IT"
                ],
                "keywords": [
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 206,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Configure Customer-Managed Keys for Azure Files | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/storage/files/customer-managed-keys"
                }
            }
        ]
    }
}