Skip to content

Commit 880f75b

Browse files
committed
incorp feedback
1 parent d7c996d commit 880f75b

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

articles/storage/common/storage-service-encryption.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ Rotating the key does not trigger re-encryption of data in the storage account.
108108

109109
### Revoke access to customer-managed keys
110110

111-
You can revoke the storage account's access to the customer-managed key at any time. After access to customer-managed keys is revoked, or after the key has been disabled or deleted, operations that read from or write to a blob or its metadata are not permitted. All other data operations are permitted. The specific operations that are not permitted are:
111+
You can revoke the storage account's access to the customer-managed key at any time. After access to customer-managed keys is revoked, or after the key has been disabled or deleted, clients cannot call operations that read from or write to a blob or its metadata. Attempts to call any of the following operations will fail with error code 403 (Forbidden) for all users:
112112

113113
- [List Blobs](/rest/api/storageservices/list-blobs), when called with the `include=metadata` parameter on the request URI
114114
- [Get Blob](/rest/api/storageservices/get-blob)
@@ -128,7 +128,9 @@ You can revoke the storage account's access to the customer-managed key at any t
128128
- [Put Page From URL](/rest/api/storageservices/put-page-from-url)
129129
- [Incremental Copy Blob](/rest/api/storageservices/incremental-copy-blob)
130130

131-
After customer-managed keys are revoked for the storage account, calling any of the listed operations will fail with error code 403 (Forbidden) for all users. To call these operations again, restore access to the customer-managed key.
131+
To call these operations again, restore access to the customer-managed key.
132+
133+
All data operations that are not listed in this section may proceed after customer-managed keys are revoked or a key is disabled or deleted.
132134

133135
To revoke access to customer-managed keys, use [PowerShell](storage-encryption-keys-powershell.md#revoke-customer-managed-keys) or [Azure CLI](storage-encryption-keys-cli.md#revoke-customer-managed-keys).
134136

0 commit comments

Comments
 (0)