Service Bus Premium namespaces should use a customer-managed key for encryption
Azure Service Bus supports encrypting data at rest with either Microsoft-managed keys (default) or customer-managed keys. Service Bus only supports encryption with customer-managed keys for premium namespaces. This control checks Premium namespaces.
Choosing to encrypt data using customer-managed keys enables you to assign, rotate, disable, and revoke access to the keys that Service Bus will use to encrypt data in your namespace.
What this control checks
Service Bus Premium namespaces should use a customer-managed key for encryption
Common pitfalls
Only premium namespaces support customer-managed keys
Note that Service Bus only supports encryption with customer-managed keys for premium namespaces.
Microsoft-managed keys are the default
Azure Service Bus supports the option of encrypting data at rest with either Microsoft-managed keys (default) or customer-managed keys.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Service Bus Premium namespaces should use a customer-managed key for encryption" (295fc8b1-dc9f-4f53-9c61-3f313ceab40a); PowerPipe control azure_compliance.control.servicebus_premium_namespace_cmk_encrypted.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_201.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-12 (Cryptographic Key Establishment and Management).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-12 (Cryptographic Key Establishment And Management).
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
servicebus_premium_namespace_cmk_encrypted - Checkov Check:
CKV_AZURE_201 - Powerpipe Control:
azure_compliance.control.servicebus_premium_namespace_cmk_encrypted - Azure Policy Definition:
295fc8b1-dc9f-4f53-9c61-3f313ceab40a
Last reviewed: 2026-10-15