{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-152-account-for-the-elastic-san-key-rotation-gap-in-azure-monitor-logs/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-152-account-for-the-elastic-san-key-rotation-gap-in-azure-monitor-logs/", "slug": "dse-20260917-152-account-for-the-elastic-san-key-rotation-gap-in-azure-monitor-logs", "url": "https://update.dsesecurity.com/updates/dse-20260917-152-account-for-the-elastic-san-key-rotation-gap-in-azure-monitor-logs/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-152-account-for-the-elastic-san-key-rotation-gap-in-azure-monitor-logs.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-152-account-for-the-elastic-san-key-rotation-gap-in-azure-monitor-logs/" }, "title": "Account for the Elastic SAN key-rotation gap in Azure Monitor logs", "summary": "DSE recommends documenting this gap in the rotation evidence plan before the change window.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:28+00:00", "modified_at": "2026-09-17T16:46:28+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 2, "word_count": 228, "potentially_affected": "Use this guide when defining the evidence required for a customer-managed-key rotation affecting an Azure Elastic SAN volume group. Its focus is the documented monitoring gap and the responsibility boundary, rather than the schedule for retiring an older key.", "dse_recommendation": "DSE recommends documenting this gap in the rotation evidence plan before the change window.", "primary_source": { "name": "Manage Customer-Managed Keys - Azure Elastic SAN | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/elastic-san/elastic-san-encryption-manage-customer-keys", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft states that rotating the customer-managed key is not currently recorded in Azure Monitor logs for Elastic SAN. The guide places responsibility for creating a new key version in Key Vault on the customer; Elastic SAN does not perform that rotation. Microsoft Learn

\n

Applicability

\n

Use this guide when defining the evidence required for a customer-managed-key rotation affecting an Azure Elastic SAN volume group. Its focus is the documented monitoring gap and the responsibility boundary, rather than the schedule for retiring an older key.

\n

DSE recommendation

\n

DSE recommends documenting this gap in the rotation evidence plan before the change window. Assign the vault owner responsibility for recording the key-version operation and the storage owner responsibility for recording the volume-group configuration. Identify each affected resource and timestamp without exporting key material. Agree how reviewers will distinguish a missing Elastic SAN log event from a missing change record, and retain those observations with the authorized request.

\n

Verification

\n

After the approved exercise, reconcile the retained vault-version and volume-group observations with the planned operation. Ask the reviewer to state which evidence demonstrates each step and which conclusions remain unproven. Do not use an empty Elastic SAN log search as evidence that no rotation occurred. Escalate an incomplete record for investigation instead of filling the gap with an assumed event.

\n

Official references

\n", "content_text": "Source facts\nMicrosoft states that rotating the customer-managed key is not currently recorded in Azure Monitor logs for Elastic SAN. The guide places responsibility for creating a new key version in Key Vault on the customer; Elastic SAN does not perform that rotation. Microsoft Learn\nApplicability\nUse this guide when defining the evidence required for a customer-managed-key rotation affecting an Azure Elastic SAN volume group. Its focus is the documented monitoring gap and the responsibility boundary, rather than the schedule for retiring an older key.\nDSE recommendation\nDSE recommends documenting this gap in the rotation evidence plan before the change window. Assign the vault owner responsibility for recording the key-version operation and the storage owner responsibility for recording the volume-group configuration. Identify each affected resource and timestamp without exporting key material. Agree how reviewers will distinguish a missing Elastic SAN log event from a missing change record, and retain those observations with the authorized request.\nVerification\nAfter the approved exercise, reconcile the retained vault-version and volume-group observations with the planned operation. Ask the reviewer to state which evidence demonstrates each step and which conclusions remain unproven. Do not use an empty Elastic SAN log search as evidence that no rotation occurred. Escalate an incomplete record for investigation instead of filling the gap with an assumed event.\nOfficial references\n\nMicrosoft: Manage Customer-Managed Keys – Azure Elastic SAN | Microsoft Learn", "content_markdown": "## Source facts\n\nMicrosoft states that rotating the customer-managed key is not currently recorded in Azure Monitor logs for Elastic SAN. The guide places responsibility for creating a new key version in Key Vault on the customer; Elastic SAN does not perform that rotation. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/elastic-san/elastic-san-encryption-manage-customer-keys)\n\n## Applicability\n\nUse this guide when defining the evidence required for a customer-managed-key rotation affecting an Azure Elastic SAN volume group. Its focus is the documented monitoring gap and the responsibility boundary, rather than the schedule for retiring an older key.\n\n## DSE recommendation\n\nDSE recommends documenting this gap in the rotation evidence plan before the change window. Assign the vault owner responsibility for recording the key-version operation and the storage owner responsibility for recording the volume-group configuration. Identify each affected resource and timestamp without exporting key material. Agree how reviewers will distinguish a missing Elastic SAN log event from a missing change record, and retain those observations with the authorized request.\n\n## Verification\n\nAfter the approved exercise, reconcile the retained vault-version and volume-group observations with the planned operation. Ask the reviewer to state which evidence demonstrates each step and which conclusions remain unproven. Do not use an empty Elastic SAN log search as evidence that no rotation occurred. Escalate an incomplete record for investigation instead of filling the gap with an assumed event.\n\n## Official references\n\n- [Microsoft: Manage Customer-Managed Keys – Azure Elastic SAN | Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/elastic-san/elastic-san-encryption-manage-customer-keys)" }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-152-account-for-the-elastic-san-key-rotation-gap-in-azure-monitor-logs/", "url": "https://update.dsesecurity.com/updates/dse-20260917-152-account-for-the-elastic-san-key-rotation-gap-in-azure-monitor-logs/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-152-account-for-the-elastic-san-key-rotation-gap-in-azure-monitor-logs/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Account for the Elastic SAN key-rotation gap in Azure Monitor logs", "item": "https://update.dsesecurity.com/updates/dse-20260917-152-account-for-the-elastic-san-key-rotation-gap-in-azure-monitor-logs/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-152-account-for-the-elastic-san-key-rotation-gap-in-azure-monitor-logs/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-152-account-for-the-elastic-san-key-rotation-gap-in-azure-monitor-logs/", "url": "https://update.dsesecurity.com/updates/dse-20260917-152-account-for-the-elastic-san-key-rotation-gap-in-azure-monitor-logs/", "headline": "Account for the Elastic SAN key-rotation gap in Azure Monitor logs", "description": "DSE recommends documenting this gap in the rotation evidence plan before the change window.", "abstract": "DSE recommends documenting this gap in the rotation evidence plan before the change window.", "articleBody": "Source facts\nMicrosoft states that rotating the customer-managed key is not currently recorded in Azure Monitor logs for Elastic SAN. The guide places responsibility for creating a new key version in Key Vault on the customer; Elastic SAN does not perform that rotation. Microsoft Learn\nApplicability\nUse this guide when defining the evidence required for a customer-managed-key rotation affecting an Azure Elastic SAN volume group. Its focus is the documented monitoring gap and the responsibility boundary, rather than the schedule for retiring an older key.\nDSE recommendation\nDSE recommends documenting this gap in the rotation evidence plan before the change window. Assign the vault owner responsibility for recording the key-version operation and the storage owner responsibility for recording the volume-group configuration. Identify each affected resource and timestamp without exporting key material. Agree how reviewers will distinguish a missing Elastic SAN log event from a missing change record, and retain those observations with the authorized request.\nVerification\nAfter the approved exercise, reconcile the retained vault-version and volume-group observations with the planned operation. Ask the reviewer to state which evidence demonstrates each step and which conclusions remain unproven. Do not use an empty Elastic SAN log search as evidence that no rotation occurred. Escalate an incomplete record for investigation instead of filling the gap with an assumed event.\nOfficial references\n\nMicrosoft: Manage Customer-Managed Keys – Azure Elastic SAN | Microsoft Learn", "datePublished": "2026-09-17T16:32:28+00:00", "dateModified": "2026-09-17T16:46:28+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-152-account-for-the-elastic-san-key-rotation-gap-in-azure-monitor-logs/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-152-account-for-the-elastic-san-key-rotation-gap-in-azure-monitor-logs/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Account for the Elastic SAN key-rotation gap in Azure Monitor logs" }, "articleSection": [ "IT" ], "keywords": [ "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 228, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Manage Customer-Managed Keys - Azure Elastic SAN | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/storage/elastic-san/elastic-san-encryption-manage-customer-keys" } } ] } }