How to Secure Azure Storage with Customer-Managed Keys and Managed Identities

When building cloud-native applications, securing your storage resources is a top priority. Azure provides powerful tools like Managed Identities, Key Vault, Customer-Managed Keys (CMKs), and Immutable Storage to help you do just that.

In this guide, we’ll walk through how to:

• Create a storage account with infrastructure encryption
• Set up a managed identity and assign access
• Create a Key Vault with customer-managed keys
• Configure your storage account to use those keys
• Set up immutable blob storage and encryption scopes

---

✅ Step 1: Create the Storage Account

1. In the Azure Portal, search for Storage accounts and click + Create.
2. Create a new Resource Group, name it accordingly.
3. Provide a unique name for your storage account.
4. Navigate to the Encryption tab.
5. Enable the checkbox for Infrastructure encryption.

⚠️ This cannot be changed after creation.

1. Click Review + Create, then Create the storage account.

✅ Step 2: Create a User-Assigned Managed Identity

1. In the Azure Portal, search for Managed identities and click + Create.
2. Choose the same Resource Group.
3. Name your managed identity (e.g., ezekielmanagedidentity).
4. Click Review + create, then Create.

---

✅ Step 3: Assign Storage Permissions to the Managed Identity

1. Go to your Storage Account > Access Control (IAM).
2. Click + Add role assignment.
3. Select Storage Blob Data Reader.
4. On the Members tab:

• Choose Managed identity
• Select User-assigned managed identity
• Pick the identity you created earlier
  1. Click Review + assign (twice to confirm).

✅ Step 4: Give Yourself Key Vault Administrator Access

1. Go to Resource Group > Access Control (IAM).
2. Click + Add role assignment.
3. Choose the Key Vault Administrator role.
4. Select User, group, or service principal.
5. Pick your user account from the list.
6. Click Review + assign (twice).

✅ Step 5: Create a Key Vault and a Key

1. In the Azure Portal, search for Key vaults and click + Create.
2. Use your existing Resource Group and give the vault a unique name.
3. On the Access Configuration tab, ensure Azure role-based access control (recommended) is selected.
4. Click Review + create, then Create.
5. After deployment, click Go to resource.
6. Confirm that Soft-delete and Purge protection are enabled.
7. Under Keys, click + Generate/Import.
8. Provide a name, leave other settings as default, and click Create.

✅ Step 6: Grant Encryption Role to the Managed Identity

1. Go to your Resource Group > Access Control (IAM).
2. Click + Add role assignment.
3. Select Key Vault Crypto Service Encryption User.
4. Choose Managed identity, then select your user-assigned identity.
5. Click Review + assign (twice).

---

✅ Step 7: Configure Customer-Managed Key on the Storage Account

1. Go back to your Storage Account > Encryption.
2. Switch to Customer-managed keys.
3. Select your Key Vault and the key you created earlier.
4. Set Identity type to User-assigned.
5. Select your managed identity and click Add.
6. Click Save.

🔁 If you get an error, wait a few minutes to let permissions propagate, then retry.

---

✅ Step 8: Configure Immutable Blob Storage

1. Navigate to your Storage Account > Containers.
2. Click + Container, name it hold, and create it with default settings.
3. Upload a test file to the container.
4. Go to Settings > Access policy.
5. Under Immutable blob storage, click + Add policy.

• Policy type: Time-based retention
• Retention period: 5 days
  1. Save the changes.

🧪 Try deleting the file. You should get a deletion failed error due to the policy.

---

✅ Step 9: Create an Encryption Scope with Infrastructure Encryption

1. Go back to your Storage Account > Encryption > Encryption scopes tab.
2. Click + Add.
3. Name your scope (e.g., myezekielwncryptionscope).
4. Set:

• Encryption type: Microsoft-managed keys
• Infrastructure encryption: Enabled
  1. Click Create.

✅ Step 10: Use the Encryption Scope in a New Container

1. Return to your Storage Account > Containers.
2. Click + Container.
3. Provide a Name and set Public access level.
4. Under Advanced, choose the Encryption scope you created.
5. Create the container.