cmek-azure-key-vault changedmanage-claude/cmek-azure-key-vault
Nearest release: v2.1.312, published under an hour before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+18added
Lines−18removed
From line
16
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits15to this page, all time
The whole hunk
from line 16, old and new numbered
/
from line 16
1616
1717* Customer-managed encryption keys (CMEK) are [turned on for your organization](https://platform.claude.com/docs/en/manage-claude/cmek#availability).
1818* You have your Anthropic organization ID, the UUID without the `org_` prefix. Copy it from [Organization](https://platform.claude.com/settings/organization) in the Claude Console, or from **Organization settings > Organization and access** on claude.ai. Whoever creates the key needs it.
19* You're an Organization Admin on Claude Platform, or an Owner or Primary Owner on Claude Enterprise.
20* On Claude Platform, you have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic's key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
19* You’re an Organization Admin on Claude Platform, or an Owner or Primary Owner on Claude Enterprise.
20* On Claude Platform, you have a workspace that [retains data](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#data-retention), ideally a new one, because [existing data stays under Anthropic’s key](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect).
2121* On Claude Enterprise, you know [which features turn off or change](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed).
2222
2323In Azure:
from line 24
2424
2525* You can create keys in your key vault and assign RBAC roles on it.
2626* You can create service principals in your Entra tenant (Application Administrator, Cloud Application Administrator, or an equivalent custom role).
27* The vault has a diagnostic setting for the `AuditEvent` log category. Without one, Anthropic's key operations leave no audit trail.
27* The vault has a diagnostic setting for the `AuditEvent` log category. Without one, Anthropic’s key operations leave no audit trail.
2828
2929## In Azure: create the key
3030
3131After a failed **Verify** or **Add**, see the [fixes for Azure Key Vault](https://platform.claude.com/docs/en/manage-claude/cmek-troubleshooting#azure-key-vault).
3232
33These steps give Anthropic's multitenant application access to your key:
33These steps give Anthropic’s multitenant application access to your key:
3434
3535* **Name:** `anthropic-cmek-client-us`
3636* **Client ID:** `8635ae1a-3e5d-44e8-a4ed-e0f614466f87`
from line 49
4949| Field | Must be |
5050| ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
5151| `rbac` | `true` |
52| `purge` | `true`. If it's `false` or `null`, turn on purge protection first. You can't turn it off again. |
53| `pub` | `"Enabled"`. Private endpoints aren't supported. |
54| `net` | `"Allow"`, or `"Deny"` with [Anthropic's outbound IP addresses](https://platform.claude.com/docs/en/api/ip-addresses#outbound-ip-addresses) in `ipRules` |
52| `purge` | `true`. If it’s `false` or `null`, turn on purge protection first. You can’t turn it off again. |
53| `pub` | `"Enabled"`. Private endpoints aren’t supported. |
54| `net` | `"Allow"`, or `"Deny"` with [Anthropic’s outbound IP addresses](https://platform.claude.com/docs/en/api/ip-addresses#outbound-ip-addresses) in `ipRules` |
5555
5656Copy `uri` (the vault URI) and `tenantId`.
5757
from line 62
6262<Tabs>
6363 <Tab title="Azure portal">
6464 <Steps>
65 <Step title="Create Anthropic's service principal">
66 Open Cloud Shell from the portal's top navigation bar. Run this command:
65 <Step title="Create Anthropic’s service principal">
66 Open Cloud Shell from the portal’s top navigation bar. Run this command:
6767
6868 ```bash
6969 az ad sp create --id 8635ae1a-3e5d-44e8-a4ed-e0f614466f87
from line 115
115115 </Frame>
116116 </Step>
117117
118 <Step title="Open the key's access control">
118 <Step title="Open the key’s access control">
119119 Open the key itself, not the vault. Select its **Access control (IAM)** tab and click **Add > Add role assignment**.
120120 </Step>
121121
from line 123
123123 On the **Role** tab, select **Key Vault Crypto User**. Click **Next**.
124124 </Step>
125125
126 <Step title="Add Anthropic's service principal">
126 <Step title="Add Anthropic’s service principal">
127127 On the **Members** tab, click **Select members**. Search for `anthropic-cmek-client-us` and select it. Click **Select**, then click **Next**.
128128 </Step>
129129
from line 135
135135
136136 <Tab title="Azure CLI">
137137 <Steps>
138 <Step title="Create Anthropic's service principal">
138 <Step title="Create Anthropic’s service principal">
139139 ```bash
140140 az ad sp create --id 8635ae1a-3e5d-44e8-a4ed-e0f614466f87
141141 ```
from line 142
142142
143143 Copy the `id` field from the output.
144144
145 If the command exits with an "already exists" error, get the `id` with this command instead:
145 If the command exits with an “already exists” error, get the `id` with this command instead:
146146
147147 ```bash
148148 az ad sp show --id 8635ae1a-3e5d-44e8-a4ed-e0f614466f87 --query id -o tsv
from line 195
195195
196196Verification fails without the organization tag. The key must be RSA, 3072-bit or larger.
197197
198Instead of creating a key, run this command in the Azure CLI or Cloud Shell. It limits the key to `wrapKey` and `unwrapKey`. It also replaces the current version's tags, so list any you want to keep in `--tags` as `name=value`.
198Instead of creating a key, run this command in the Azure CLI or Cloud Shell. It limits the key to `wrapKey` and `unwrapKey`. It also replaces the current version’s tags, so list any you want to keep in `--tags` as `name=value`.
199199
200200```bash
201201az keyvault key set-attributes \
from line 215
215215 <Tab title="Claude Platform">
216216 <Steps>
217217 <Step title="Open the encryption key settings">
218 In the Claude Console, open [Encryption keys](https://platform.claude.com/settings/privacy#encryption-keys) on the Data retention page. If the section isn't there, select **Organization** from the dropdown menu at the top.
218 In the Claude Console, open [Encryption keys](https://platform.claude.com/settings/privacy#encryption-keys) on the Data retention page. If the section isn’t there, select **Organization** from the dropdown menu at the top.
219219 </Step>
220220
221221 <Step title="Add the key">
from line 232
232232
233233 <Step title="Attach the key to a workspace">
234234 <Warning>
235 Attaching a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the workspace or replace it. If the key is deleted, Anthropic can't recover the data it protects.
235 Attaching a key [can’t be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can’t remove it from the workspace or replace it. If the key is deleted, Anthropic can’t recover the data it protects.
236236 </Warning>
237237
238238 1. At the top of the Data retention page, select the workspace from the dropdown menu.
from line 239
239239 2. Under **Encryption key**, select the key and click **Save**.
240240 3. Select the checkbox to confirm that you have read the CMEK documentation, then click **Confirm**.
241241
242 You see **Workspace settings updated.** Once the key [takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect), your cloud provider's audit log shows Anthropic's calls to the key.
242 You see **Workspace settings updated.** Once the key [takes effect](https://platform.claude.com/docs/en/manage-claude/cmek-how-it-works#when-your-key-takes-effect), your cloud provider’s audit log shows Anthropic’s calls to the key.
243243
244244 In a [ZDR organization](https://platform.claude.com/docs/en/manage-claude/cmek-data-retention#zdr-organizations), after you select the workspace, select **Standard data retention** so that **Encryption key** appears. After you click **Save**, click **Accept** on the data retention terms.
245245 </Step>
from line 250
250250 On Claude Enterprise, CMEK applies to the whole organization, and you can add only one key.
251251
252252 <Warning>
253 Adding a key [can't be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can't remove it from the organization or replace it. If the key is deleted, Anthropic can't recover the data it protects.
253 Adding a key [can’t be undone](https://platform.claude.com/docs/en/manage-claude/cmek-key-lifecycle#what-each-action-does). You can’t remove it from the organization or replace it. If the key is deleted, Anthropic can’t recover the data it protects.
254254 </Warning>
255255
256256 Adding the key [turns off or changes some features](https://platform.claude.com/docs/en/manage-claude/cmek-coverage-claude-enterprise#turned-off-or-changed) for every user. To try CMEK first, use a separate organization.
No line in this hunk matches that.