Today, we are excited to announce the General Availability of Storage Service Encryption for Azure Blob Storage. You can enable this feature on any Azure Resource Manager storage account using the Azure Portal, Azure Powershell, Azure CLI or the Microsoft Azure Storage Resource Provider API.
Storage Service Encryption for Azure Blob Storage helps you address organizational security and compliance requirements by encrypting your Blob storage (Block Blobs, Page Blobs and Append Blobs).
Storage Service Encryption (SSE) brings native data at rest encryption to Azure Blob Storage (ABS). Turning it on is a simple process:
Already have a storage account? Enable it.
Don't have a storage account? Create one. Enable it.
Yes, it's just that easy and works for the following:
General purpose storage accounts and Blob storage accounts
Standard storage and Primary storage
All redundancy levels (LRS, ZRS, GRS, RA-GRS)
Azure Resource Manager storage accounts (but not classic)
If you are enabling it on existing storage accounts, watch out for this though:
Note that SSE encrypts when blobs are written or updated. This means that when you enable SSE for an existing storage account, only new writes are encrypted; it does not go back and encrypt the data already present.