Monitor Storage Blob Encryption

Sign in to the Microsoft Azure Portal.

Navigate to Microsoft Defender for Cloud blade at https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0.

In the main navigation panel, under Management, choose Environment settings.

Click on the name (link) of the Azure subscription that you want to examine.

In the navigation panel, under Policy settings, choose Security policy.

In the Default initiative section, click on the name of the default initiative enabled for the selected subscription (i.e. ASC Default (subscription: &ltb;subscription-id>)).

Choose the Parameters tab, uncheck Only show parameters that need input or review, and search for the following parameter: Storage accounts should use customer-managed key for encryption. If the Storage accounts should use customer-managed key for encryption parameter is set to Disabled, the monitoring of the Azure Storage Accounts encrypted with customer-managed keys is not enabled in the selected subscription.

Repeat steps no. 4 – 7 for each Microsoft Azure subscription created within your Azure account.

Run account get-access-token command (Windows/macOS/Linux) using custom query filters to determine if the monitoring of the storage resources encrypted with customer-managed keys is enabled within the current Azure subscription by checking the storageAccountsShouldUseCustomerManagedKeyForEncryptionMonitoringEffect configuration parameter value:

az account get-access-token
  --query "{subscription:subscription,accessToken:accessToken}"
  --out tsv | xargs -L1 bash -c 'curl -X GET -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Authorization/policyAssignments/SecurityCenterBuiltIn?api-version=2018-05-01' | jq 'select(.name=="SecurityCenterBuiltIn")'|jq '.properties.parameters.storageAccountsShouldUseCustomerManagedKeyForEncryptionMonitoringEffect.value'

The command output should return the requested parameter value:

"Disabled"

If the account get-access-token command output returns "Disabled", as shown in the output example above, the monitoring of the Azure Storage Accounts encrypted with customer-managed keys is not enabled within the current subscription.

Repeat steps no. 1 and 2 for each Microsoft Azure subscription available in your Azure cloud account.

Sign in to the Microsoft Azure Portal.

Navigate to Microsoft Defender for Cloud blade at https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0.

In the main navigation panel, under Management, choose Environment settings.

Click on the name (link) of the Azure subscription that you want to access.

In the navigation panel, under Policy settings, choose Security policy.

In the Default initiative section, click on the name of the default initiative enabled for the selected subscription (i.e. ASC Default (subscription: <subscription-id>)).

Choose the Parameters tab and uncheck the Only show parameters that need input or review checkbox to list all the initiative parameters.

Select Audit from the Storage accounts should use customer-managed key for encryption parameter dropdown list to enable the monitoring of the Azure Storage Accounts encrypted with customer-managed keys using the Microsoft Defender for Cloud service.

Select Review + save to review the configuration changes, then choose Save to apply the new changes. If the operation is successful, the following confirmation message should be displayed: "Updating policy assignment succeeded".

Repeat steps no. 4 – 9 for each Microsoft Azure subscription available within your Azure account.

Define the configuration parameters for the account get-access-token command, where the storageAccountsShouldUseCustomerManagedKeyForEncryptionMonitoringEffect parameter is enabled to turn on the monitoring feature. Save the configuration document to a JSON file named enable-encryption-with-cmk-monitoring.json and replace the highlighted details, i.e. <azure-subscription-id> and <policy-definition-id>, with your own Azure account subscription details:

{
  "properties":{
     "displayName":"ASC Default (subscription: <azure-subscription-id>)",
     "policyDefinitionId":"/providers/Microsoft.Authorization/policySetDefinitions/<policy-definition-id>",
     "scope":"/subscriptions/<azure-subscription-id>",
     "parameters":{
        "storageAccountsShouldUseCustomerManagedKeyForEncryptionMonitoringEffect":{
           "value":"Audit"
        }
     }
  },
  "id":"/subscriptions/<azure-subscription-id>/providers/Microsoft.Authorization/policyAssignments/SecurityCenterBuiltIn",
  "type":"Microsoft.Authorization/policyAssignments",
  "name":"SecurityCenterBuiltIn",
  "location":"eastus"
}

Run account get-access-token command (Windows/macOS/Linux) using the configuration document defined at the previous step (i.e. enable-encryption-with-cmk-monitoring.json file), to enable the monitoring of the Azure Storage Accounts encrypted with customer-managed keys using the Microsoft Defender for Cloud service:

az account get-access-token
  --query "{subscription:subscription,accessToken:accessToken}"
  --out tsv | xargs -L1 bash -c 'curl -X PUT -H "Authorization: Bearer $1" -H "Content-Type: application/json" https://management.azure.com/subscriptions/$0/providers/Microsoft.Authorization/policyAssignments/SecurityCenterBuiltIn?api-version=2018-05-01 -d@"enable-encryption-with-cmk-monitoring.json"'

The command output should return information about the modified configuration parameter:

{
  "sku": {
    "name": "A0",
    "tier": "Free"
  },
  "properties": {
    "displayName": "ASC Default (subscription: abcdabcd-1234-1234-1234-abcdabcdabcd)",
    "policyDefinitionId": "/providers/Microsoft.Authorization/policySetDefinitions/1234abcd-1234-1234-1234-abcd1234abcd",
    "scope": "/subscriptions/abcdabcd-1234-1234-1234-abcdabcdabcd",
    "parameters": {
      "storageAccountsShouldUseCustomerManagedKeyForEncryptionMonitoringEffect": {
        "value": "Audit"
      }
    },
    "metadata": {
      "createdBy": "abcdabcd-1234-1234-1234-abcdabcdabcd",
      "createdOn": "2019-05-17T15:38:40.3473931Z",
      "updatedBy": "1234abcd-1234-1234-1234-abcd1234abcd",
      "updatedOn": "2022-02-01T21:22:40.7422203Z"
    }
  },
  "id": "/subscriptions/abcdabcd-1234-1234-1234-abcdabcdabcd/providers/Microsoft.Authorization/policyAssignments/SecurityCenterBuiltIn",
  "type": "Microsoft.Authorization/policyAssignments",
  "name": "SecurityCenterBuiltIn",
  "location": "eastus"
}

Repeat steps no. 1 – 3 for each Microsoft Azure subscription available in your Azure cloud account.