Data stored in your Azure Cosmos DB for MongoDB (vCore) cluster is automatically and seamlessly encrypted with keys managed by Microsoft. Now, in addition to this service-managed key encryption (SMK), you have the option to add another layer of security by enabling encryption with a customer-managed key (CMK).
Many organizations require full control of access to their data using a CMK and the ability to make their data stored in the cloud inaccessible. Data encryption with CMK for Azure Cosmos DB for MongoDB (vCore) enables you to bring your own encryption key to protect data at rest. It also enables organizations to implement separation of duties in the management of keys and data.
With CMK for data encryption, you're responsible for, and in full control of, an encryption key's life cycle, key usage permissions, and auditing of operations on keys. Data encryption with CMK for Azure Cosmos DB for MongoDB (vCore) is set at the cluster level. Data—including backups and logs, and temporary files—is encrypted on disk.