Which Azure Storage Deployment Supports Per-User Encryption Keys?

AZ-305 By islever Editorial Last updated

Design data storage solutions for semi-structured and unstructured data

Short answer

B Deploy blobs in a general purpose v2 storage account with container encryption scopes so each user's data uses a separate customer-managed key.

Question

You plan to deploy an app that will use an Azure Storage account.
You need to deploy the storage account. The storage account must meet the following requirements:
✑ Store the data for multiple users.
✑ Encrypt each user's data by using a separate key.
✑ Encrypt all the data in the storage account by using customer-managed keys.
What should you deploy?
  1. files in a premium file share storage account
  2. blobs in a general purpose v2 storage account Correct Answer
  3. blobs in an Azure Data Lake Storage Gen2 account
  4. files in a general purpose v2 storage account

Key Takeaways

Tests Azure Blob Storage encryption scopes with customer-managed keys; the trap is selecting ADLS Gen2 for per-user keys despite its hierarchical namespace.

This AZ-305 storage design question asks which Azure Storage deployment can hold data for multiple users, encrypt each user's data with a separate key, and still apply an account-wide customer-managed key. The answer is blobs in a general purpose v2 storage account (B), because Blob Storage encryption scopes assign a distinct key to each container.

Common mistake: Most candidates choose ADLS Gen2 (C) because it is also blob storage, but encryption scopes that provide separate per-container customer-managed keys are a GPv2 blob feature; Azure Files (A and D) only supports account-level CMK, not per-share key separation.

Expert Analysis

Why the Answer Is Correct

The question requires three things: multi-user storage, a separate encryption key per user's data, and customer-managed keys at the storage-account level. Blobs in a general purpose v2 (GPv2) account satisfy all three because Blob Storage supports encryption scopes, which let you assign a distinct customer-managed key to each container while the account-level CMK still encrypts everything. As NotMeAnyWay notes, a GPv2 account "supports customer-managed keys for encryption," and encryption scopes are the Azure feature that delivers per-container key isolation. kay000001 and Sandeep1981 also selected B, and the Azure documentation on encryption scopes confirms that container-level keys work in GPv2 blob accounts. Option B is therefore the direct, exam-doctrine match for the stated requirements.

Why the Other Options Are Wrong

Options A and D deploy Azure Files, which does not provide separate encryption scopes or per-share customer-managed keys; Azure Files only supports account-level CMK, so it cannot encrypt each user's data with a different key. Option C deploys blobs in an Azure Data Lake Storage Gen2 account, which is a GPv2 account with hierarchical namespace (HNS) enabled. Mltytskr pointed to the Azure feature-support table and wrote that "HNS does not support customer-provided" keys, meaning the per-container key requirement is not met in the classic exam version. Backy observed that "Today, both B and C are correct answers" and AzureGeek79 argued for C, but the AZ-305 exam item is built around the GPv2 blob answer, and ADLS Gen2 adds an analytics namespace that the scenario never asks for.

Community Comment Notes

NotMeAnyWay and kay000001 both chose B, with NotMeAnyWay explaining that GPv2 supports customer-managed keys and that encryption scopes enable a separate key per user's data. Mltytskr cited the Microsoft feature-support page and noted that HNS accounts do not support customer-provided keys, which supports choosing B over C. vrm1358 and TaoLu highlighted container-level encryption scopes and metadata as the mechanism for per-user keys, reinforcing the blob-container design. Backy cautioned that current Azure support may make C valid too, but the exam answer remains B because the question tests the GPv2 blob encryption-scope model. AzureGeek79's vote for C is understandable only if you ignore the HNS limitation tested by the original item.

Exam Strategy Tip

When an AZ-305 storage question says "separate key per user" or "per-container encryption," map that immediately to Blob Storage encryption scopes in a general purpose v2 account. Eliminate Azure Files for per-share key isolation, and treat ADLS Gen2 as a hierarchical-namespace variant that the exam generally rules out for separate CMKs. Read the requirement about account-wide customer-managed keys as a confirmation that the account must support CMK, which GPv2 does.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Anchor on the phrase "separate key per user's data" and translate it to Blob Storage encryption scopes; that single mapping eliminates Azure Files and points to a GPv2 blob account. If two blob options remain, choose the one without hierarchical namespace because encryption scopes with customer-managed keys are tested there in AZ-305.

Frequently Asked Questions

Why is ADLS Gen2 not the answer for per-user encryption keys?

ADLS Gen2 enables a hierarchical namespace, and the exam treats encryption scopes with per-container customer-managed keys as a GPv2 blob feature; it also adds analytics overhead not required here.

How do encryption scopes give each user a separate key?

Each blob container gets its own encryption scope that references a distinct customer-managed key in Azure Key Vault, while the account-level key still encrypts all data in the storage account.

More AZ-305 FAQ →

Discussion 35 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 35

  1. NotMeAnyWay 👍 27 Answered B
    B. blobs in a general purpose v2 storage account A General Purpose v2 (GPv2) storage account can store blobs, files, queues, and tables, making it a versatile option for a wide range of applications. It supports customer-managed keys for encryption, allowing you to maintain control over the encryption keys. To encrypt each user's data with a separate key, you can use Azure Blob Storage Service Encryption with customer-managed keys, storing each user's data in separate containers, and then configuring separate encryption keys for each container.
  2. Mltytskr 👍 9
    Data Lake on GPv2 means hierarchical namespace (HNS) is enabled, and according to: https://learn.microsoft.com/en-us/azure/storage/blobs/storage-feature-support-in-storage-accounts, HNS does not support customer-managed keys so it would have to be B.
  3. vrm1358 👍 4
    @ this moment, Azure support configuring separate encryption keys for each container. https://learn.microsoft.com/en-us/azure/storage/blobs/encryption-scope-manage?utm_source=chatgpt.com&tabs=portal
  4. Mltytskr 👍 4
    Sorry, meant customer-provided, not managed, which I think is required because of "Encrypt each user's data by using a separate key." Open to correction.
  5. TaoLu 👍 4
    az storage container create --name <container_name> --public-access off --metadata encryptionScope="<customer_managed_key_url>"
Show 25 more comments
  1. Backy 👍 3
    This reference does not say such things, it merely states that Data Lake support for encryption scopes is in Preview. However, the actual Azure storage account for Data Lake does not mention any preview and provides full support for encryption scopes. Apparently, the Microsoft docs have not been updated yet. Probably, this is very old question. Today, both B and C are correct answers to this question
  2. randomaccount123 👍 3
    Yeah that makes sense. I also realized after writing the comment that it mentions 'app'. Therefore most of the time you will want to use blob. Files is more for typical file servers and mounting.
  3. Sandeep1981 👍 3 Answered B
    B is the answer
  4. amandatajes 👍 2 Answered C
    A. Premium file share: Supports CMK but not per-user key separation. B. Blobs in general-purpose v2: Supports CMK, but encryption scopes (per-user key separation) are only available in ADLS Gen2. D. Files in general-purpose v2: Similar to A, lacks encryption scopes and fine-grained key control. ✅ Why this is the best choice: Requirement Why ADLS Gen2 Fits Multi-user data storage ADLS Gen2 supports hierarchical namespaces and fine-grained access control (via ACLs), ideal for multi-user environments. Per-user encryption keys ADLS Gen2 supports encryption scopes, allowing you to assign different customer-managed keys (CMKs) to different containers or even individual blobs. Customer-managed keys Full support for CMKs stored in Azure Key Vault or Azure Key Vault Managed HSM.
  5. Joule 👍 2 Answered C
    B. Blobs in an Azure Data Lake Storage Gen2 account would be the best option to meet the given requirements. Azure Data Lake Storage Gen2 offers support for object storage and is designed to store and analyze large amounts of unstructured data. It also offers the ability to use customer-managed keys for encryption and supports the use of Azure Key Vault. Additionally, ADLS Gen2 offers a hierarchical namespace, which makes it easy to manage large data sets and access them efficiently.
  6. MelKr 👍 2 Answered B
    At the time the question was designed only B would have been correct. Currently, C is also correct. The question requires support for two features: 1. Encryption scopes (different users encrypt with different keys) 2. Customer managed keys with key vault https://learn.microsoft.com/en-us/azure/storage/blobs/storage-feature-support-in-storage-accounts: Check for current support of these features for the different types of blob storage configurations.
  7. leoletopic 👍 2
    is "Encrypt each user's data by using a separate key." means "Provide an encryption key on a request to Blob storage" reference : https://learn.microsoft.com/en-us/azure/storage/blobs/encryption-customer-provided-keys if so ,this feature not support Data Lake Storage Gen2, Network File System (NFS) 3.0 protocol, or the SSH File Transfer Protocol (SFTP) So, I think it is B
  8. 7054bfc 👍 2
    THIS-->You can specify a customer-managed key to use for encrypting and decrypting data in Blob Storage and in AZURE FILES. https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption#about-encryption-key-management
  9. 23169fd 👍 2
    B and C are correct but B is a better choice because if the application involves big data analytics, C would be more appropriate. For general-purpose storage, B is suitable.
  10. AzureGeek79 👍 2 Answered C
    ADLS Gen2 is the only option that meets all three requirements: multi-user access, per-user encryption keys, and CMK for the entire account, hence the correct answer is C.
  11. sainandam 👍 2
    B - HNS does not support encryption keys on request. https://learn.microsoft.com/en-us/azure/storage/blobs/encryption-customer-provided-keys
  12. yj123 👍 2
    i guess gpv2 disk encryption will be applied to whole disk while blob encryption can be applied to individual blob
  13. sporting1 👍 2
    I'm a bit confused. What is the difference between B and C?
  14. OPT_001122 👍 2 Answered B
    B. blobs in a general purpose v2 storage account
  15. Lazylinux 👍 2
    Do Not shout we are deaf!!!
  16. techmaster1507 👍 2 Answered B
    Correct!
  17. Backy 👍 1 Answered C
    The question asks for Encryption scopes, so either B or C would work. The other services like Files, Tables, Queues do not use Encryption scopes The question seems to ask also for access control on level of each blob data, where each blob is assigned to separate user(s) and this is provided only by Data Lake Storage, so the answer is C
  18. TJ001 👍 1
    not quite - pls read this https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json#about-encryption-key-management It is possible to use different CMK for each containers by defining scope
  19. Finalflame 👍 1 Answered D
    B and D are correct: https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json#about-encryption-key-management
  20. armpro 👍 1 Answered B
    Ans: B Only blobs can use customer provided keys for container level or blob level custom encryption https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption#about-encryption-key-management
  21. rjcverar 👍 1 Answered C
    Seems that Becky is right. Both B or C would work, but the question indeed seems to infer that each blob is assigned to "multiple customers", aka C.
  22. 4a3a329 👍 1
    with file share and ad authentication u can setup icacl per every user and actually have better control then in blob.
  23. malcubierre 👍 1
    I don't think you can choose different keys on every container.... contiguration is at storage level, not container.
  24. MadSysadmin 👍 1
    B and C are different, eg. Data Lake Storage supports paths and subdirectories
  25. randomaccount123 👍 1
    Can someone explain why the others aren't right? Why is files gpv2 wrong?

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Azure Network Watcher IP Flow Verify vs Traffic Analytics

S-grade

Which components handle AKS state, pub/sub, and traffic splitting?

S-grade

Which Azure Storage setup retains blobs immutably for five years?

S-grade

Which Azure Monitor Features Provide Synthetic Transaction Monitoring for App1?

S-grade

Practice All AZ-305 Questions

Access 95 questions with complete answers and detailed explanations.

View Full AZ-305 Practice Test →

← Back to AZ-305 Study Guide