# Source: https://docs.datadoghq.com/security/default_rules/def-000-3l9.md

---
title: >-
  Storage account containing the blob container with activity logs should be
  encrypted with Customer Managed Key
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Storage account containing the blob
  container with activity logs should be encrypted with Customer Managed Key
---

# Storage account containing the blob container with activity logs should be encrypted with Customer Managed Key
 
## Description{% #description %}

Storage accounts with activity log exports have the option to utilize Customer Managed Keys (CMKs) for encryption. By default, storage accounts use vendor managed keys for encryption. However, configuring the storage account to use CMKs enhances confidentiality controls on log data, requiring the user to have read permission on the storage account and decrypt permission by the CMK. It is important to note that setting up a key vault is necessary to use CMKs, as all Audit Logs are encrypted using a key provided by the user. The user is responsible for managing the lifecycle of the keys and replacing them at regular intervals to maintain data security.

## Remediation{% #remediation %}

### From the console{% #from-the-console %}

1. Navigate to the Storage accounts blade.
1. Click on the storage account.
1. Under **Security + networking**, click **Encryption**.
1. Next to **Encryption type**, select **Customer-managed keys**.
1. Complete the steps to configure a customer-managed key for encryption of the storage account.

### From the command line{% #from-the-command-line %}

```bash
az storage account update --name <name of the storage account> --resource- group <resource group for a storage account> --encryption-key- source=Microsoft.Keyvault --encryption-key-vault <Key Vault URI> -- encryption-key-name <KeyName> --encryption-key-version <Key Version>
```

### Using PowerShell{% #using-powershell %}

```
Set-AzStorageAccount -ResourceGroupName <resource group name> -Name <storage account name> -KeyvaultEncryption -KeyVaultUri <key vault URI> -KeyName <key name>
```

## References{% #references %}

1. [https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-data-protection#dp-5-encrypt-sensitive-data-at-rest](https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-data-protection#dp-5-encrypt-sensitive-data-at-rest)
1. [https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log?tabs=cli#managing-legacy-log-profiles](https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log?tabs=cli#managing-legacy-log-profiles)