Encryption: Microsoft-managed vs customer-managed keys in Key Vault, infrastructure encryption, encryption scopes

All data written to Azure Storage is encrypted at rest automatically with 256-bit AES (Advanced Encryption Standard) encryption, a feature called Azure Storage encryption or Storage Service Encryption (SSE). You cannot turn it off, and it costs nothing extra. Encryption and decryption are transparent: applications read and write data normally, with no code changes. What you choose is who manages the keys and whether to add extra layers. That distinction, rather than whether data is encrypted, is what exam questions test.