Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Set up Customer-managed Keys in Microsoft Sentinel

4 September 2026Doc update+24 / −23 lines

In brief

The article now has clearer customer-managed key terminology, reorganized headings, updated key-rotation links, and refreshed related-content links and formatting.

What Defender admins need to know

Use the updated article for current navigation and CMK setup guidance; no administrator action is specified.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

title: Set up customer-Customer-managed keysKeys in Microsoft Sentinel description: Learn howConfigure customer-managed keys (CMK) for Microsoft Sentinel to set up customer-managedadd an extra encryption layer using a key (CMK)you create and manage in Microsoft Sentinel.Azure Key Vault. ms.author: edbaynash author: EdB-MSFT ms.reviewer: amyhari - Microsoft Sentinel in the Microsoft Defender portal - Microsoft Sentinel in the Azure portal ai-usage: ai-assisted ms.custom: msecd-doc-authoring-10141016

#Customer intent: As a security administrator, I want to configure a customer-managed key for Microsoft Sentinel so that I can enhance data protection with my own encryption key.

Set up Microsoft Sentinel customer-managed key

This article provides background information and steps to configure a customer-managed key (CMK) for Microsoft Sentinel. All the data stored in Microsoft Sentinel is already encrypted by Microsoft in all relevant storage resources. CMK provides an extra layer of protection with an encryption key created and owned by you and stored in your Azure Key Vault. Before you begin, review the prerequisites, including the requirement for a Log Analytics dedicated cluster.

Prerequisites

  1. Configure a Log Analytics dedicated cluster with at least a 100 GB/day commitment tier. When multiple workspaces are linked to the same dedicated cluster, they share the same customer-managed key. Learn about Log Analytics Dedicated Cluster Pricing.
  2. Configure CMK on the dedicated cluster and link your workspace to that cluster. Learn about the CMK provisioning steps in Azure Monitor.

Data protected by CMK

Once CMK is enabled, the following data is protected:

  • Onboarding a CMK workspace to Microsoft Sentinel is supported only via REST API and the Azure CLI, and not via the Azure portal. Azure Resource Manager templates (ARM templates) currently aren't supported for CMK onboarding.

  • In the following cases, only ingested data in Log Analytics tables are encrypted with CMK, while all other data is encrypted with Microsoft-managed keys:

    • Enabling CMK on a workspace that's already onboarded to Microsoft Sentinel.
    • Enabling CMK on a cluster that contains Microsoft Sentinel-enabled workspaces.
    • Linking a Microsoft Sentinel-enabled, non-CMK workspace to a CMK-enabled cluster.

  • The following CMK-related changes are not supported because they may lead to undefined and problematic behavior:

    • Setting a Sentinel-onboarded, CMK-enabled workspace as a non-CMK workspace by unlinking it from its CMK-enabled dedicated cluster.
    • Disabling CMK on a CMK-enabled Log Analytics dedicated cluster.

  • Microsoft Sentinel supports System Assigned Identities in CMK configuration. Therefore, the dedicated Log Analytics cluster's identity should be a System Assigned identity. We recommend that you use the identity that's automatically assigned to the Log Analytics cluster when it's created.

  • Changing the customer-managed key to another key (with another URI) currently isn't supported. Change the key by rotating it.

  • Before you make any CMK changes to a production workspace or to a Log Analytics cluster, contact the Microsoft Sentinel Product Groupusing key rotation.

How CMK workscustomer-managed keys work in Microsoft Sentinel

The Microsoft Sentinel solution uses a dedicated Log Analytics cluster for log collection and features. As part of the Microsoft Sentinel CMK configuration, you must configure the CMK settings on the related Log Analytics dedicated cluster.

For more information, see:

Enable CMK

To provision CMK, follow these steps:

Add an access policy that allows Azure Cosmos DB to access the Azure Key Vault instance that is linked to your dedicated Log Analytics cluster (the same key will be used by Microsoft Sentinel).

Follow the instructions to add an access policy to your Azure Key Vault instance with an Azure Cosmos DB principal.

:::image type="content" source="./media/customer-managed-keys/add-access-policy-principal.png" lightbox="./media/customer-managed-keys/add-access-policy-principal.png" alt-text="Screenshot of the Select principal option on the Add access policy page.":::

Step 4: Onboard the workspace to Microsoft Sentinel via the onboarding API

The following PUT request creates or updates the Microsoft Sentinel onboarding state for the workspace with customer-managed key support enabled.

URI

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/onboardingStates/{sentinelOnboardingStateName}?api-version=2021-03-01-preview

The following request body sets the customerManagedKey property to true, which enables customer-managed key support for the onboarding state.

Request body

{
"properties": {

Microsoft Sentinel doesn't support replacing a customer-managed key. You should use the [key rotation capability](#customer-managed-key-rotation) instead.

## Next steps
In this document, you learned how to set up a customer-managed key in Microsoft Sentinel. To learn more about Microsoft Sentinel, see the following articles:
- Learn how to [get visibility into your data, and potential threats](get-visibility.md).
- Get started [detecting threats with Microsoft Sentinel](./detect-threats-built-in.md).
- [Use workbooks](monitor-your-data.md) to monitor your data.
\ No newline at end of file
## Related content

- [Visualize collected data on the Overview page](get-visibility.md)
- [Threat detection in Microsoft Sentinel](threat-detection.md)
- [Visualize and monitor your data by using workbooks in Microsoft Sentinel](monitor-your-data.md)