How to get Azure storage account Infrastructure encryption status in powershell

Question

I am trying to check the Infrastructure encryption status via powershell. Here is the screenshot Encryption

I referenced this doc("https://learn.microsoft.com/en-us/azure/storage/common/infrastructure-encryption-enable?tabs=portal") and tried the below script but didn't get any result.

$account = Get-AzStorageAccount -ResourceGroupName ` -StorageAccountName $account.Encryption.RequireInfrastructureEncryption

Is there a way to see if the Infrastructure encryption is enabled or disabled?

Thank you

Nancy Xiong · Accepted Answer · 2020-12-04 02:11:30Z

1

From that docs, there are two kinds of encryption levels for Azure storage account, at the service level and at the infrastructure level. By default, Azure Storage automatically encrypts all data in a storage account at the service level using 256-bit AES encryption, customers who require higher levels of assurance that their data is secure can also enable 256-bit AES encryption at the Azure Storage infrastructure level.

To doubly encrypt your data, you must first create a storage account that is configured for infrastructure encryption.

In this case, if you have not enabled the infrastructure encryption, you could see the "requireInfrastructureEncryption": null with Azure CLI.

az storage account show --name <storage-account> --resource-group <resource-group>

To Verify that infrastructure encryption is enabled, you could Register to use infrastructure encryption,

Register-AzProviderFeature -ProviderNamespace Microsoft.Storage `
    -FeatureName AllowRequireInfraStructureEncryption

Create an account with infrastructure encryption enabled,

New-AzStorageAccount -ResourceGroupName <resource_group> `
    -AccountName <storage-account> `
    -Location <location> `
    -SkuName "Standard_RAGRS" `
    -Kind StorageV2 `
    -RequireInfrastructureEncryption

Then you can Verify that infrastructure encryption is enabled with the PowerShell scripts.

$account = Get-AzStorageAccount -ResourceGroupName <resource-group> `
    -StorageAccountName <storage-account>
$account.Encryption.RequireInfrastructureEncryption

answered Dec 4, 2020 at 2:11

Nancy Xiong

28.3k3 gold badges22 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Jack Smith Over a year ago

Thank you for the great explanation! it helped :)

Jack Smith Over a year ago

@Nanxy Xiong, if it is disabled do I get false as a return value?

Nancy Xiong Over a year ago

From that Azure CLI result, you will see by default if it is disabled, you get null instead of false as a return value, you can check it with PowerShell $result = $account.Encryption.RequireInfrastructureEncryption -eq $null

Gill-Bates Over a year ago

Please be aware, that you have to enable Infrastructure Encryption during the initial creation of a Storage Account! You cannot enable it later.

Collectives™ on Stack Overflow

How to get Azure storage account Infrastructure encryption status in powershell

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related