# Check where a saved Log Analytics query lives before claiming customer-key protection

> Distinguish query packs from the linked-storage route for customer-managed encryption.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-042-check-where-a-saved-log-analytics-query-lives-before-claiming-customer-key/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:18+00:00
- Modified: 2026-09-17T16:35:04+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Distinguish query packs from the linked-storage route for customer-managed encryption.

## Potentially affected

Use this review when a monitoring team has a specific requirement to protect saved query text through a customer-managed key. Identify the actual save location, workspace, linked account and encryption configuration. A cluster encryption setting alone is insufficient evidence about where a particular saved query resides.

## DSE recommendation

DSE recommends classifying representative saved queries by storage location before selecting the configuration.

## Article

## Source facts

Microsoft states that queries saved in a query pack are not stored in the linked storage account and cannot use its customer-managed encryption. The guide recommends saving a legacy query for that protection. The linked account must be StorageV2, share the workspace region, and itself be configured with a customer-managed key. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/customer-managed-keys).

## Applicability

Use this review when a monitoring team has a specific requirement to protect saved query text through a customer-managed key. Identify the actual save location, workspace, linked account and encryption configuration. A cluster encryption setting alone is insufficient evidence about where a particular saved query resides.

## DSE recommendation

DSE recommends classifying representative saved queries by storage location before selecting the configuration. Have the monitoring and key owners agree which query artifacts require this protection. Review the source’s migration considerations before changing a workspace link, including its instructions to copy existing saved queries and functions beforehand.

## Verification

Save a harmless representative query through the intended documented path and inspect its location alongside the linked account’s encryption settings. Record the account type, region and key reference without exposing sensitive query text. Keep query-pack artifacts outside a successful protection claim unless a separate supported approach is established.

## Official references

[Microsoft Learn: Azure Monitor Customer-Managed Keys](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/customer-managed-keys).

## Primary reference

- Name: Azure Monitor Customer-Managed Keys - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/customer-managed-keys
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check where a saved Log Analytics query lives before claiming customer-key protection,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-042-check-where-a-saved-log-analytics-query-lives-before-claiming-customer-key/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.