How to create an encryption scope protected by customer-managed keys in a different tenant in azure for the single storage account with multiple customer keys

Hello Varun R,

Thanks for reaching out Microsoft Q&A,

So wanted to know if I can use multiple keys for the single storage account from multiple customer keys and that will create an encryption scope for that customer key uri will be able to upload a blob using that. Is there a way possible or there is one key per one storage account possibility in azure

Yes, you can create multiple encryption scopes in a single Azure Storage account, each protected by a different customer-managed key (CMK), including those from key vaults residing in different Microsoft Entra tenants. This allows you to extend secure, isolated encryption to multiple customers within the same storage account, each with their own key URI, even across tenant boundaries.

• Azure Storage supports up to 10,000 encryption scopes per account, each of which can be protected by its own customer-managed key from Azure Key Vault, even if those key vaults are in different Entra tenants. - Encryption scopes for Blob storage - Azure Storage | Microsoft Learn
• To achieve this, first configure your Storage account with cross-tenant customer-managed keys using a user-assigned managed identity(federated identity) that has permissions to access each customer's Key Vault in their respective tenants - Create and manage encryption scopes - Azure Storage | Microsoft Learn
• For each customer, you create a new encryption scope within the storage account, specifying the customer's key URI for that scope. Data (blobs) can then be created and encrypted within the appropriate scope, leveraging the desired customer key.​
• This ensures that blobs can be encrypted and decrypted only with their respective customer’s key and does not limit your account to a single cross-tenant key. Blobs encrypted with different encryption scopes (and keys) can coexist within the same storage account.

Configure cross-tenant customer-managed keys for an existing storage account - Azure Storage | Microsoft Learn

Hello Venkatesan , I created federated credential with the user assigned managed identity inside a multitenant app also I added this user assigned managed identity to the storage account inside my tenant and registered this multitenant app in customer tenant with the service principal and then added RBAC Key Vault Crypto Service Encryption User to this app's SP and try to create an encryption scope with the sdk and also with az cli , but I am getting 400

(ClientAppCannotBeAuthorized) Client Application cannot be authorized to perform this action.
Code: ClientAppCannotBeAuthorized
Message: Client Application cannot be authorized to perform this action.

The error ClientAppCannotBeAuthorized you face often means the authorization setup is incomplete or incorrect:

• Ensure the multi-tenant app is correctly installed in the customer tenant.
• The service principal of that app in the customer tenant must be granted the appropriate RBAC role (Key Vault Crypto Service Encryption User) on the customer's key vault.
• The federated identity credential must be correctly configured between the user-assigned managed identity and the multi-tenant app's client ID.
• The user-assigned managed identity must be assigned (added) to the storage account in your tenant and used when creating the encryption scope.
• Make sure purge protection is enabled on the customer key vault and the key is in an enabled state.
• Double-check the permissions and identity binding using Azure Portal, PowerShell, or Azure CLI.

Hence, having multiple encryption scopes each linked to distinct customer keys in different tenants within one storage account is supported. Your next step is to verify and correct the cross-tenant multi-tenant app and managed identity authorizations to resolve the 400 error.

Also, for testing purpose try to use the Key Vault Data Access Administrator to your Service principal.

For detailed step-by-step guidance, follow this Configure cross-tenant customer-managed keys for an existing storage account - Azure Storage | Microsoft Learn

No I believe the app and permissions are configured correctly in the customer tenant correctly , because I can upload a blob using the key uri by doing this sectionhttps://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-configure-cross-tenant-existing-account?tabs=azure-portal#configure-customer-managed-keys-for-an-existing-account
but this action makes other blobs inaccessible uploaded using other keys , because it sets the encryption Identity to the federated credential id's app Id and gives the encryption scope not found error 409 and if I remove this and try to create an encryption scope it gives me 400 client app cannot be authorized. Despite having user assigned managed identity added to storage account