Issue with Policy Enforcement on Storage Account Encryption

Hi @Daniel Omonemu , I understand you have enabled built-in Azure Policy "Storage account encryption scopes should use customer-managed keys to encrypt data at rest" with "Deny" effect. You question why storage accounts can still use MMK (Microsoft-Managed Key).

Storage account encryption scopes need to be created for your storage account. It is different from the key that is scoped to the entire storage account. When you define an encryption scope, you specify a key that may be scoped to a container or an individual blob. When the encryption scope is applied to a blob, the blob is encrypted with that key.

It's possible to have storage account with MMK as the key for the entire storage account, and then you define an encryption scope using CMK (Customer-Managed Key). The policy only enforces the CMK for encryption scope. It does not enforce CMK for the entire storage account.

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.