Account for the Elastic SAN key-rotation gap in Azure Monitor logs

Source facts

Microsoft states that rotating the customer-managed key is not currently recorded in Azure Monitor logs for Elastic SAN. The guide places responsibility for creating a new key version in Key Vault on the customer; Elastic SAN does not perform that rotation. Microsoft Learn

Applicability

Use this guide when defining the evidence required for a customer-managed-key rotation affecting an Azure Elastic SAN volume group. Its focus is the documented monitoring gap and the responsibility boundary, rather than the schedule for retiring an older key.

DSE recommendation

DSE recommends documenting this gap in the rotation evidence plan before the change window. Assign the vault owner responsibility for recording the key-version operation and the storage owner responsibility for recording the volume-group configuration. Identify each affected resource and timestamp without exporting key material. Agree how reviewers will distinguish a missing Elastic SAN log event from a missing change record, and retain those observations with the authorized request.

Verification

After the approved exercise, reconcile the retained vault-version and volume-group observations with the planned operation. Ask the reviewer to state which evidence demonstrates each step and which conclusions remain unproven. Do not use an empty Elastic SAN log search as evidence that no rotation occurred. Escalate an incomplete record for investigation instead of filling the gap with an assumed event.

Official references

• Microsoft: Manage Customer-Managed Keys – Azure Elastic SAN | Microsoft Learn