If backups are encrypted, are encryption keys stored offline?
Backups you cannot decrypt are backups you do not have. This question exists because that discovery is usually made during a recovery.
What the carrier is actually asking
The carrier is asking whether the key material protecting your backups survives the loss of the environment those backups protect. If the key lives only in the encrypted estate, an event that takes out the estate takes out the recovery with it.
Why it is underwritten
Attackers who cannot delete an immutable copy will settle for making it unreadable, and the fastest route is the key vault. Beyond attack, ordinary key loss during a rebuild is a recurring cause of failed recoveries. The carrier is underwriting the ability to actually restore, and key custody is a precondition of that.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Cloud key custody is readable. Physical custody of an offline key is attested and should be documented.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Azure | Key Vault soft delete and purge protection on vaults holding backup keys | Purge protection enabled, so a deleted key can be recovered rather than being permanently gone |
| Azure | Key Vault access policies or role assignments | A short list, separate from production administration, with no standing delete rights for daily accounts |
| Azure | Key rotation policies and expiry on keys and secrets | Rotation configured, with the old key retained long enough to read older backups |
| Offline custody | Escrow, safe, or sealed envelope process for the master key or recovery passphrase | A documented custody process with named custodians and a tested retrieval path. Attested |
| Recovery plan | The step that retrieves key material during a recovery | Written down, since retrieving a key under a documented process is very different from finding it in a chat log |
Key custody fails at retrieval far more often than at storage. The envelope exists and the person who knows the safe combination left the company. A custody process that has never been exercised is an assumption dressed as a control.
What a defensible yes requires
- Key material exists outside the environment it protects, in a form that survives that environment being lost.
- Cloud key stores have purge protection, so keys cannot be permanently deleted by a compromised administrator.
- Custodians are named, plural, and current.
- Retrieval has been exercised recently and the elapsed time is known.
- Historical keys are retained long enough to read the oldest backup you would rely on.
How this answer goes wrong
The pattern is a passphrase stored in the documentation platform hosted in the same tenant as everything else. It is protected, it is access-controlled, and it is inside the blast radius. The second pattern is rotation without retention: keys rotate diligently and the old key is discarded, so backups older than the last rotation cannot be read.
Frequently asked
Does offline mean literally offline?
It means outside the failure domain. A sealed envelope in a safe qualifies. So does a key in a separate tenant with separate administration. What does not qualify is a key reachable with the same credentials as the data.
Is a hardware security module required?
Not to answer this question yes. It strengthens custody and matters more where regulation or contract requires it.
What about the backup product passphrase?
Same rule. It is key material, and it belongs in custody with named custodians rather than in the product documentation or the deployment runbook.
How often should retrieval be tested?
At least annually, and after any change of custodian. Fold it into the restore test so both are exercised in one exercise.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture