Storage encryption: customer-managed vs Microsoft-managed keys

Verdict: Service-side encryption is always on. Choose customer-managed keys in Key Vault when you must own and audit rotation. Microsoft-managed keys rotate under Microsoft. Infrastructure encryption always adds a second Microsoft-managed key.

Criterion	Customer-managed keys	Microsoft-managed keys	Infrastructure encryption
Who controls rotation	The customer, on their own schedule	Microsoft handles all rotation	Microsoft (uses Microsoft-managed keys)
Where the key lives	Azure Key Vault or Key Vault Managed HSM	Platform-managed, not customer-visible	Platform-managed, separate from the service key
Auditable schedule	Yes	No	No
What it changes	Only the key, not that encryption happens	Default; encryption is on by default	Optional second layer for double encryption
Choose when	Compliance requires owning/auditing rotation	No key-control requirement	A second encryption layer is mandated

Rules

Customer-managed keys must be stored in Azure Key Vault or Key Vault Managed HSM, and key rotation control sits with the customer so it can be managed and audited.
Service-side encryption is always on; customer-managed keys only change the key, not whether encryption happens. Infrastructure encryption always uses Microsoft-managed keys.
Managed disks encrypted with customer-managed keys cannot be moved between subscriptions at all.

Traps

With Microsoft-managed or infrastructure encryption, Microsoft controls rotation, so the customer cannot audit the schedule - only customer-managed keys give that.
Deallocating a VM lets a CMK disk move to another resource group, but never across subscriptions; same-region Key Vault and key rotation do not unlock a cross-subscription move.