A compliance program requires that every storage account in a subscription use customer-managed keys for encryption at rest, rather than the default Microsoft-managed keys. Which policy effect blocks non-compliant accounts from being created?
Show answer and explanation
Answer: D
Azure Storage encrypts data at rest by default, so the meaningful control is which key protects it. The built-in policy for customer-managed keys can be set to Deny, which rejects any deployment that would create or update a storage account without a customer-managed key. Audit only reports after the fact, Disabled enforces nothing, and Append cannot reliably supply the Key Vault key reference that a customer-managed key requires.
Why the other options are wrong
- A. Append can add properties to a request, but it cannot reliably supply the Key Vault key reference that a customer-managed key needs.
- B. Audit records non-compliant accounts after they exist, so the storage is already created and the requirement is only reported, not enforced.
- C. Disabled turns the policy off entirely, so nothing is checked or blocked, which fails the compliance requirement.