# Confirm the Azure Files resource provider before applying storage-account CMK guidance

> DSE recommends capturing the share’s resource identifier and provider before preparing the key configuration.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-074-confirm-the-azure-files-resource-provider-before-applying-storage-account-cmk/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:46+00:00
- Modified: 2026-09-17T16:38:45+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 1 minutes

## What you need to know

DSE recommends capturing the share’s resource identifier and provider before preparing the key configuration.

## Potentially affected

This check is for an Azure Files encryption change where the team must first establish that the selected account and share match the documented procedure.

## DSE recommendation

DSE recommends capturing the share’s resource identifier and provider before preparing the key configuration.

## Article

## Source facts

Microsoft limits this procedure to classic SMB and NFS shares created through Microsoft.Storage and excludes shares created through Microsoft.FileShares. For the covered storage account, Azure Files data uses the configured customer key without a separate opt-in for each share. The documented Key Vault setup requires purge protection. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/files/customer-managed-keys)

## Applicability

This check is for an Azure Files encryption change where the team must first establish that the selected account and share match the documented procedure.

## DSE recommendation

DSE recommends capturing the share’s resource identifier and provider before preparing the key configuration. List the covered storage account, intended vault and key, responsible identity owner, and recovery controls in the change record. Have the storage and key owners agree the account-level scope before proceeding. Route a share from a different resource provider to its applicable guidance rather than carrying this procedure across by name alone.

## Verification

Verify the resource provider and account encryption configuration against the approved scope. Confirm the selected vault’s protection settings and retain the observed key reference without exposing sensitive material. Test the agreed file-access scenario after the authorized change and record any unresolved access or configuration difference.

## Official references

- [Microsoft: Configure Customer-Managed Keys for Azure Files | Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/files/customer-managed-keys)

## Primary reference

- Name: Configure Customer-Managed Keys for Azure Files | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/storage/files/customer-managed-keys
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Confirm the Azure Files resource provider before applying storage-account CMK guidance,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-074-confirm-the-azure-files-resource-provider-before-applying-storage-account-cmk/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.