Check where a saved Log Analytics query lives before claiming customer-key protection

Source facts

Microsoft states that queries saved in a query pack are not stored in the linked storage account and cannot use its customer-managed encryption. The guide recommends saving a legacy query for that protection. The linked account must be StorageV2, share the workspace region, and itself be configured with a customer-managed key. Microsoft Learn.

Applicability

Use this review when a monitoring team has a specific requirement to protect saved query text through a customer-managed key. Identify the actual save location, workspace, linked account and encryption configuration. A cluster encryption setting alone is insufficient evidence about where a particular saved query resides.

DSE recommendation

DSE recommends classifying representative saved queries by storage location before selecting the configuration. Have the monitoring and key owners agree which query artifacts require this protection. Review the source’s migration considerations before changing a workspace link, including its instructions to copy existing saved queries and functions beforehand.

Verification

Save a harmless representative query through the intended documented path and inspect its location alongside the linked account’s encryption settings. Record the account type, region and key reference without exposing sensitive query text. Keep query-pack artifacts outside a successful protection claim unless a separate supported approach is established.

Official references

Microsoft Learn: Azure Monitor Customer-Managed Keys.