How can I encrypt existing data in ALL Azure storage accounts across multiple subscriptions

Question

There is old, unencrypted data that has to be encrypted. I enabled encryption for future data but want to make sure all data across storage accounts is encrypted at rest.

I know that I can use AZCopy to move data, but is there a way to keep the current storage accounts but encrypt the data inside?

Answer 1

Currently there is no other way to encrypt existing data.

SSE only encrypts newly created data after the encryption is enabled. If for example you create a new Resource Manager storage account but don't turn on encryption, and then you upload blobs or archived VHDs to that storage account and then turn on SSE, those blobs will not be encrypted unless they are rewritten or copied.

Answer 2

Only option to encrypt the data within the same Storage Account is to copy the data to another container. https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption