Are backups encrypted?
Almost everyone answers yes, and almost everyone is right. The question that carries the risk is what protects the keys.
What the carrier is actually asking
The carrier is asking whether backup data is unreadable to someone who obtains the media or the storage: encryption at rest for stored copies and in transit while they move. In modern platforms this is largely default, which is why the meaningful part of the answer is key custody rather than the encryption itself.
Why it is underwritten
Unencrypted backups turn a theft or a misconfigured storage bucket into a full data breach without any need to touch production. For regulated data, encryption also changes the notification calculus in several jurisdictions, which is a direct cost to the carrier. Because the control is nearly free, its absence reads as a broader hygiene problem.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Encryption state for cloud-resident data is directly readable. Backup product encryption is attested.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Azure | Storage account encryption, and infrastructure encryption for double encryption at rest | Encryption at rest enabled, with infrastructure encryption for the most sensitive datasets |
| Azure | Customer-managed keys on storage accounts holding critical data | Where you have chosen customer-managed keys, the key is in a vault with purge protection and a rotation policy |
| Azure | Secure transfer required, and minimum TLS version on storage accounts | In-transit protection enforced rather than optional |
| Azure | Disk encryption on virtual machines and unattached disks | Disks encrypted, including the unattached ones left behind by decommissioning, which are a common quiet exposure |
| Backup product | Encryption settings and passphrase or key custody | Encryption enabled and the key held somewhere other than inside the system being backed up. Attested |
An encrypted backup whose key lives in the environment being backed up is encrypted against theft of the media and not against the incident you actually fear. Key custody is the part of this answer that changes outcomes, and the related question about offline key storage exists for exactly that reason.
What a defensible yes requires
- Backups are encrypted at rest and in transit as a matter of configuration, not assumption.
- Keys are held outside the systems being backed up, with a documented custody arrangement.
- Key stores are protected against deletion, so an attacker cannot make backups unreadable rather than deleting them.
- Key rotation exists and has been exercised, since an unrotated key is a credential that never expires.
- Unattached and legacy disks are covered, because decommissioning leaves encrypted-by-default gaps.
How this answer goes wrong
The answer is rarely wrong and often shallow. Organisations confirm encryption and cannot say who holds the keys, where the passphrase is, or what happens if the person who set it up is unavailable. In a real recovery that becomes the blocking issue: the backups are intact, encrypted, and nobody can open them.
Frequently asked
Is platform default encryption enough?
For this question, generally yes. Platform-managed encryption at rest is an accepted answer. Customer-managed keys become relevant when regulation or contract requires key separation.
Does encryption help after ransomware?
Not against the encryption itself. It matters for the exfiltration half of a double-extortion event, where stolen backup data is worthless if the attacker cannot read it.
Where should backup keys live?
In a key vault with purge protection, outside the environment being backed up, with a documented emergency access path. A passphrase in the same tenant as the data is not custody.
What about tape?
Hardware encryption on the drive with keys held separately is the standard answer, and the key custody question applies with more force, because tape outlives the people who configured it.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture