Confirm the Azure Files resource provider before applying storage-account CMK guidance

Source facts

Microsoft limits this procedure to classic SMB and NFS shares created through Microsoft.Storage and excludes shares created through Microsoft.FileShares. For the covered storage account, Azure Files data uses the configured customer key without a separate opt-in for each share. The documented Key Vault setup requires purge protection. Microsoft Learn

Applicability

This check is for an Azure Files encryption change where the team must first establish that the selected account and share match the documented procedure.

DSE recommendation

DSE recommends capturing the share’s resource identifier and provider before preparing the key configuration. List the covered storage account, intended vault and key, responsible identity owner, and recovery controls in the change record. Have the storage and key owners agree the account-level scope before proceeding. Route a share from a different resource provider to its applicable guidance rather than carrying this procedure across by name alone.

Verification

Verify the resource provider and account encryption configuration against the approved scope. Confirm the selected vault’s protection settings and retain the observed key reference without exposing sensitive material. Test the agreed file-access scenario after the authorized change and record any unresolved access or configuration difference.

Official references

• Microsoft: Configure Customer-Managed Keys for Azure Files | Microsoft Learn