From c753d8abe86addd66f7d3f62bf24c7e4cb3e1ab5 Mon Sep 17 00:00:00 2001 From: bwatts64 <32721128+bwatts64@users.noreply.github.com> Date: Tue, 25 Aug 2026 15:23:37 -0400 Subject: [PATCH] Update customer-managed keys documentation Added information about Azure Key Vault Managed HSM support and its configuration. --- data-explorer/customer-managed-keys.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/data-explorer/customer-managed-keys.md b/data-explorer/customer-managed-keys.md index 474e2fd762..7b9c49f3d0 100644 --- a/data-explorer/customer-managed-keys.md +++ b/data-explorer/customer-managed-keys.md @@ -11,7 +11,12 @@ ms.date: 03/15/2026 Azure Data Explorer encrypts all data in a storage account at rest. By default, it uses Microsoft-managed keys for encryption. If you want more control over the encryption keys, you can provide customer-managed keys for data encryption. -You must store customer-managed keys in an [Azure Key Vault](/azure/key-vault/key-vault-overview). You can create your own keys and store them in a key vault, or you can use an Azure Key Vault API to generate keys. The Azure Data Explorer cluster and the key vault must be in the same region, but they can be in different subscriptions. For a detailed explanation of customer-managed keys, see [customer-managed keys with Azure Key Vault](/azure/storage/common/storage-service-encryption). +You must store customer-managed keys in an [Azure Key Vault](/azure/key-vault/key-vault-overview) or [Azure Key Vault Managed HSM](/azure/security/fundamentals/encryption-customer-managed-keys-support). + +> [!NOTE] +> Configuring Azure Key Vault Managed HSM is only supported via API or REST calls + +You can create your own keys and store them in a key vault, or you can use an Azure Key Vault API to generate keys. The Azure Data Explorer cluster and the key vault must be in the same region, but they can be in different subscriptions. For a detailed explanation of customer-managed keys, see [customer-managed keys with Azure Key Vault](/azure/storage/common/storage-service-encryption). This article shows you how to configure customer-managed keys.