DP-700: how to implement encryption at rest for data in Fabric

I will teach how to implement encryption at rest for data in Microsoft Fabric — an important skill for the DP-700, because it protects sensitive data and is often required in analytics solution designs. Knowing how to configure keys, validate encryption and understand shared responsibility models is crucial both for the exam and for real implementations.

What you need to know

Encryption at rest ensures that stored data — files, tables, blobs, and metadata — is encrypted when not being processed. In the context of Fabric, this often involves:

• Platform-managed encryption (service-managed keys): Fabric manages encryption keys without additional configuration by the user.
• Customer-managed keys (CMK) or Bring Your Own Key (BYOK): the customer manages the keys using Azure Key Vault and configures the service to use those keys.
• Responsibility models: Microsoft provides encryption at the infrastructure level; the customer is responsible for managing their keys (when using CMK) and protecting access credentials.

Practical example: encrypting a Data Lake in OneLake so that Delta files and Lakehouse data are encrypted with a customer-managed key in Azure Key Vault.

How it works

Key steps and components:

1. Azure Key Vault: create a Key Vault and generate or import a key (Key Vault Key). Configure access policies (Access Policies or RBAC) to allow the Fabric/Storage service to access the key.
2. Synchronize identities: assign a Managed Identity (identity assigned to the Fabric service or Storage resource) with Get and UnwrapKey/WrapKey permissions as required in the Key Vault.
3. Configure CMK on the storage resource: on the resource that backs OneLake/Storage, enable the option to use a Customer-managed key and point to the Key Vault Key. The service validates the key and starts encrypting new data with that key.
4. Key rotation: plan and perform key rotation in the Key Vault. Optionally, use key versions and test compatibility before removing old versions.
5. Auditing and monitoring: enable logging (Azure Monitor, Activity Logs) and alerts for Key Vault and Storage operations to detect accesses and encryption failures.

In practice

Simplified step-by-step example (conceptual):

// 1. Create Key Vault (Azure CLI - conceptual)  az keyvault create --name myKeyVault --resource-group RG --location westeurope    // 2. Create key in the Key Vault  az keyvault key create --vault-name myKeyVault --name myCMK --kty RSA    // 3. Grant permissions to the Managed Identity of the Fabric/Storage service  az keyvault set-policy --name myKeyVault --object-id <managed-identity-object-id> --key-permissions wrapKey unwrapKey get    // 4. Configure Storage/OneLake resource to use CMK (portal or ARM template)  // In the portal: Storage Account > Encryption > Customer-managed key > select Key Vault and key    // 5. Test writing and reading data in the Lakehouse, validate that encryption operations do not fail  

Practical notes:

• When using CMK, if the key is removed or the Managed Identity loses permissions, the service may be unable to access encrypted data — planning for high availability and recovery is essential.
• Not all Fabric components expose the same interface to configure CMK; follow the resource documentation (for example, Storage Account or the OneLake resource configuration).

Common mistakes

• Insufficient permissions on the Key Vault: forgetting to grant the Managed Identity the required permissions (Get, WrapKey, UnwrapKey) is a frequent cause of encryption/decryption failures.
• Removing or rotating keys without planning: rotating or deleting a key version in production without updating the service configuration leads to inability to decrypt existing data.
• Assuming full coverage: relying on CMK to solve all risks while still needing to apply access controls, retention policies and monitoring to protect sensitive data.

How to practice

Practice in controlled environments (dev/test subscriptions): create a Key Vault, generate keys and configure a Storage Account or a Fabric-compatible resource to use CMK. Test writing, reading and key rotation. For exam preparation, use the official free Microsoft Practice Assessment and the official DP-700 study guide (both free) to validate the measured topics. Do not use dumps; focus on understanding concepts and practical execution.

In summary

• Encryption at rest protects stored data; it can be platform-managed or customer-managed (CMK/BYOK).
• CMK requires Azure Key Vault, a Managed Identity with appropriate permissions and configuration of the storage resource.
• Plan for key rotation and recovery; incorrect permissions or removal of keys lead to loss of access to data.
• Practice in your environment, use the official Practice Assessment and the Microsoft study guide to consolidate knowledge.