# Cis Azure Storage 5.1.4 > Ensure 'Use infrastructure encryption for this vault' is enabled on Backup vaults - Skill: `cyberstrikeus/cis-azure-storage-5-1-4` (Agent Skill) - Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-azure-storage-5-1-4` - Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-azure-storage-5-1-4/raw - Safety review: PASS (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/cyberstrikeus/cis-azure-storage-5-1-4 --- # 5.1.4 Ensure 'Use infrastructure encryption for this vault' is enabled on Backup vaults (Automated) ## Description In addition to using customer-managed keys for encryption at rest in the Backup vault, you can enable an additional layer of platform-managed infrastructure encryption. This dual-layer approach enhances the protection of your backup data. ## Rationale Enabling infrastructure encryption on a Backup vault adds a second layer of protection to backup data, enhancing security and ensuring compliance for sensitive data storage. This dual-layer strategy reduces the risk of unauthorized access by keeping data encrypted even if one layer is compromised. ## Impact Enabling infrastructure encryption on a backup vault does not incur additional costs; however, infrastructure encryption must be configured when creating the vault and requires customer-managed keys for encryption at rest. This recommendation is linked to `Ensure backup data in Backup vaults is encrypted using customer-managed keys (CMK)` and should be applied alongside it if you choose to implement this recommendation. ## Audit Procedure ### Audit from Azure Portal 1. Go to `Backup vaults`. 2. Click the name of a Backup vault. 3. Under `Manage`, click `Properties`. 4. Under `Encryption Settings`, click `Update`. 5. Under `Infrastructure encryption`, ensure the box next to `Use infrastructure encryption for this vault` is checked. 6. Repeat steps 1-5 for each Backup vault. ### Audit from Azure CLI Run the following command to list Backup vaults: ```bash az dataprotection backup-vault list ``` For each Backup vault, run the following command: ```bash az dataprotection backup-vault show --resource-group --vault-name ``` Ensure that under `properties` > `securitySettings` > `encryptionSettings`, `infrastructureEncryption` is set to `Enabled`. ### Audit from PowerShell Run the following command to list Backup vaults: ```powershell Get-AzDataProtectionBackupVault ``` Run the following command to get the Backup vault in a resource group with a given name: ```powershell $vault = Get-AzDataProtectionBackupVault -ResourceGroupName -VaultName ``` Run the following command to get the infrastructure encryption setting for the Backup vault: ```powershell $vault.EncryptionSetting.CmkInfrastructureEncryption ``` Ensure that the command returns `Enabled`. Repeat for each Backup vault. ### Audit from Azure Policy If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure. If referencing a printed copy, you can search Policy IDs from this URL: https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Definitions - Policy ID: `d6588149-9f06-462c-a076-56aece45b5ba` - Name: '[Preview]: Azure Backup Vaults should use customer-managed keys for encrypting backup data. Also an option to enforce Infra Encryption.' ## Expected Result `Infrastructure encryption` should be checked/enabled in the Azure Portal, or `properties.securitySettings.encryptionSettings.infrastructureEncryption` should be `Enabled` in CLI output, or `$vault.EncryptionSetting.CmkInfrastructureEncryption` should return `Enabled` in PowerShell. ## Remediation ### Remediate from Azure CLI Run the following command to create a locally redundant Backup vault with a customer-managed encryption key and infrastructure encryption enabled: ```bash az dataprotection backup-vault create --resource-group --vault-name --location --storage-setting "[{type:'LocallyRedundant',datastore-type:'VaultStore'}]" --type "UserAssigned" --user-assigned-identities '{"":{}}' --cmk-encryption-key-uri --cmk-encryption-state Enabled --cmk-identity-type "UserAssigned" --cmk-user-assigned-identity-id --cmk-infrastructure-encryption Enabled ``` ### Remediate from PowerShell Run the following commands to create a locally redundant Backup vault with a customer-managed encryption key and infrastructure encryption enabled: ```powershell $sub = "" $storagesetting = New-AzDataProtectionBackupVaultStorageSettingObject -DataStoreType VaultStore -Type LocallyRedundant $userAssignedIdentity = @{ "" = @{ clientId = "" principalId = "" } } $cmkIdentityId = "" $cmkKeyUri = "" New-AzDataProtectionBackupVault -SubscriptionId $sub -ResourceGroupName -VaultName -Location -StorageSetting $storagesetting -IdentityType UserAssigned -UserAssignedIdentity $userAssignedIdentity -CmkEncryptionState Enabled -CmkIdentityType UserAssigned -CmkUserAssignedIdentityId $cmkIdentityId -CmkEncryptionKeyUri $cmkKeyUri -CmkInfrastructureEncryption Enabled ``` ## Default Value Infrastructure encryption is disabled by default on Backup vaults. ## References 1. https://learn.microsoft.com/en-us/cli/azure/dataprotection/backup-vault 2. https://learn.microsoft.com/en-us/powershell/module/az.dataprotection/get-azdataprotectionbackupvault 3. https://learn.microsoft.com/en-us/powershell/module/az.dataprotection/new-azdataprotectionbackupvault 4. https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-manage-user-assigned-managed-identities ## Additional Information Backup vaults use user-assigned managed identities to authenticate the Backup vault to access encryption keys stored in Azure Key Vault when creating the vault with a customer-managed encryption key and infrastructure encryption enabled. Refer to the following guides for details: - https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-manage-user-assigned-managed-identities - https://learn.microsoft.com/en-us/azure/backup/encryption-at-rest-with-cmk-for-backup-vault ## CIS Controls | Controls Version | Control | IG 1 | IG 2 | IG 3 | | ---------------- | ------------------------------------------ | ---- | ---- | ---- | | v8 | 3.11 Encrypt Sensitive Data at Rest | | X | X | | v7 | 14.8 Encrypt Sensitive Information at Rest | | | X | ## Profile Level 2 | Automated