SQL managed instances should use customer-managed keys to encrypt data at rest
Implementing Transparent Data Encryption (TDE) with your own key provides increased transparency and control over the TDE Protector. It also provides increased security with an HSM-backed external service and promotion of separation of duties.
Implementing Transparent Data Encryption (TDE) with your own key provides you with increased transparency and control over the TDE Protector, increased security with an HSM-backed external service, and promotion of separation of duties.
What this control checks
Checks whether SQL managed instances use customer-managed keys for encryption at rest
Common pitfalls
Effect defaults to Audit
The effect parameter allows Audit, Deny and Disabled. Its defaultValue is Audit.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "SQL managed instances should use customer-managed keys to encrypt data at rest" (ac01ad65-10e5-46df-bdd9-6b0cad13e1d2); PowerPipe control azure_compliance.control.mssql_managed_instance_encryption_at_rest_using_cmk.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-12 (Cryptographic Key Establishment and Management).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-12 (Cryptographic Key Establishment And Management).
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
- 0304.09o3Organizational.1-09.o 09.07 Media Handling
Related controls
- Azure Synapse workspaces should use customer-managed keys to encrypt data at rest
- HPC Cache accounts should use customer-managed keys for encryption
- Unattached managed disks should be encrypted with ADE or customer-managed keys
- SQL databases should have transparent data encryption enabled
- Key vaults should have deletion protection enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
mssql_managed_instance_encryption_at_rest_using_cmk - Powerpipe Control:
azure_compliance.control.mssql_managed_instance_encryption_at_rest_using_cmk - Azure Policy Definition:
ac01ad65-10e5-46df-bdd9-6b0cad13e1d2
Last reviewed: 2026-10-13