# Account for the Elastic SAN key-rotation gap in Azure Monitor logs

> DSE recommends documenting this gap in the rotation evidence plan before the change window.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-152-account-for-the-elastic-san-key-rotation-gap-in-azure-monitor-logs/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:28+00:00
- Modified: 2026-09-17T16:46:28+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 2 minutes

## What you need to know

DSE recommends documenting this gap in the rotation evidence plan before the change window.

## Potentially affected

Use this guide when defining the evidence required for a customer-managed-key rotation affecting an Azure Elastic SAN volume group. Its focus is the documented monitoring gap and the responsibility boundary, rather than the schedule for retiring an older key.

## DSE recommendation

DSE recommends documenting this gap in the rotation evidence plan before the change window.

## Article

## Source facts

Microsoft states that rotating the customer-managed key is not currently recorded in Azure Monitor logs for Elastic SAN. The guide places responsibility for creating a new key version in Key Vault on the customer; Elastic SAN does not perform that rotation. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/elastic-san/elastic-san-encryption-manage-customer-keys)

## Applicability

Use this guide when defining the evidence required for a customer-managed-key rotation affecting an Azure Elastic SAN volume group. Its focus is the documented monitoring gap and the responsibility boundary, rather than the schedule for retiring an older key.

## DSE recommendation

DSE recommends documenting this gap in the rotation evidence plan before the change window. Assign the vault owner responsibility for recording the key-version operation and the storage owner responsibility for recording the volume-group configuration. Identify each affected resource and timestamp without exporting key material. Agree how reviewers will distinguish a missing Elastic SAN log event from a missing change record, and retain those observations with the authorized request.

## Verification

After the approved exercise, reconcile the retained vault-version and volume-group observations with the planned operation. Ask the reviewer to state which evidence demonstrates each step and which conclusions remain unproven. Do not use an empty Elastic SAN log search as evidence that no rotation occurred. Escalate an incomplete record for investigation instead of filling the gap with an assumed event.

## Official references

- [Microsoft: Manage Customer-Managed Keys – Azure Elastic SAN | Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/elastic-san/elastic-san-encryption-manage-customer-keys)

## Primary reference

- Name: Manage Customer-Managed Keys - Azure Elastic SAN | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/storage/elastic-san/elastic-san-encryption-manage-customer-keys
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Account for the Elastic SAN key-rotation gap in Azure Monitor logs,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-152-account-for-the-elastic-san-key-rotation-gap-in-azure-monitor-logs/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.