Choose between service-managed and customer-managed encryption keys - Azure Tutorial

- [Instructor] The DP-420 exam is going to ask you about how do you validate particularly to your compliance team that your Cosmos DB data is encrypted at-rest given that you don't own the data centers, you're trusting Microsoft? Well, Microsoft gives us some control as customers. We've got what's called storage service encryption and what this gives us is the ability to just stay with the default option. That's the service-managed key. This is where Microsoft applies AES-256 encryption to your Cosmos DB data at-rest in the Azure data centers. Now when your data is called into action, the service-managed key automatically decrypts the data. But when it's at-rest and not in use, it is encrypted. Now to help customers who have further compliance requirements. Now what you should note here is two things. CMK or customer-managed key is not instead of the service-managed key, it's optional on top of it. So you're double…