Microsoft Certified: Cloud and AI Security Engineer Associate (replaces Azure Security Engineer Associate / AZ-500) SC-500 · Domain 2: Secure storage, databases, and networking

Storage encryption: Microsoft-managed vs customer-managed keys, infrastructure encryption, immutable blob storage

▶ Watch the overview video

Last reviewed September 25, 2026 · Leer en español

All data written to Azure Storage is encrypted at rest automatically with 256-bit AES using Azure Storage encryption (also called storage service encryption). You cannot turn it off, and it is transparent to applications. The question is who controls the keys.

Free account

Keep reading for free

Create a free StudyToCert account to read the rest of this lesson: 5 more sections, 4 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.

Study SC-500 for free
A week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.

Open the SC-500 study plan