Can infrastructure (double) encryption be enabled on an existing Azure Service Bus namespace? Does it require the namespace to be recreated?

Hi @Hailey Martinez ,

Thanks for reaching out to Microsoft Q&A.

Currently, to enable infrastructure encryption, your namespace must switch from using Microsoft-managed keys to customer-managed keys. You can enable this later by updating your Azure Resource Manager template with the requireInfrastructureEncryption property.

Importantly, you don’t need to recreate the namespace to implement this change, so you should be able to do this without downtime.

Here's a snippet of how to update it in your template:

"properties": {
   "encryption": {
      "keySource": "Microsoft.KeyVault",
      "requireInfrastructureEncryption": true,
      "keyVaultProperties": [
         {
            "keyName": "[parameters('keyName')]",
            "keyVaultUri": "[parameters('keyVaultUri')]"
         }
      ]
   }
}

Steps to Enable Double Encryption:

1. Confirm that you want to switch from Microsoft-managed keys to customer-managed keys.
2. Update the configuration using the Azure Resource Manager template as shown above.
3. Validate that the change is successfully applied.

References:

• Configure customer-managed keys for encrypting Azure Service Bus data at rest
• ISbNamespace.RequireInfrastructureEncryption Property Definition
• ISbNamespaceUpdateParameters.EncryptionRequireInfrastructureEncryption Property Definition

Hope it helps!

Please do not forget to click "Accept the answer” and Yes, this can be beneficial to other community members.

If you have any other questions, let me know in the "comments" and I would be happy to help you.

Yes, infrastructure (double) encryption can be enabled on an existing Azure Service Bus namespace that is using Microsoft-managed keys. This can be done without recreating the namespace. You can switch from Microsoft-managed keys to customer-managed keys and enable infrastructure encryption by updating the Azure Resource Manager template with the requireInfrastructureEncryption property. This means that there is no need for downtime or recreation of the namespace to implement this standard.

References:

• Configure customer-managed keys for encrypting Azure Service Bus data at rest
• Command