---
title: Customer-managed encryption keys for Azure Native Service
description: Elastic Cloud Hosted deployments created through the Azure Native Service are full-featured deployments that support the same security capabilities as...
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7599/deploy-manage/deploy/elastic-cloud/azure-native-isv-service-byok
products:
  - Elastic Cloud Hosted
applies_to:
  - Elastic Cloud Hosted: Preview
---

# Customer-managed encryption keys for Azure Native Service
Elastic Cloud Hosted deployments created through the Azure Native Service are full-featured deployments that support the same security capabilities as any other Elastic Cloud Hosted deployment.
By default, Elastic already encrypts your deployment data and snapshots at rest. You can reinforce this mechanism by providing your own encryption key, also known as Bring Your Own Key (BYOK). For a full description of how this works and the security benefits it provides, refer to [Use a customer-managed encryption key](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/7599/deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key).
BYOK is not available as a configuration option when creating a deployment from the Azure portal. You can add a customer-managed key to your deployment after it is created, by accessing the Elastic Cloud console.

## Prerequisites

Before configuring BYOK, you need an RSA key in Azure Key Vault and the necessary permissions to create a service principal for Elastic Cloud in your Azure tenant. Refer to [BYOK prerequisites](/elastic/docs-content/pull/7599/deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key#ec_prerequisites_3) for the full list.

## Add a customer-managed key to your deployment

1. In the Azure portal, navigate to your deployment's overview page.
2. Select the **Advanced Settings** link to open the Elastic Cloud console.
3. Follow the steps in [Encrypt an existing deployment with your key](/elastic/docs-content/pull/7599/deploy-manage/security/encrypt-deployment-with-customer-managed-encryption-key#ec_encrypt_an_existing_deployment_with_a_customer_managed_key).