Merge pull request #107796 from yossi-y/patch-57

Key rotation clarification

Author: PRMerger20

articles/azure-monitor/platform/customer-managed-keys.md

@@ -90,9 +90,7 @@ The following rules apply:
 - The AEK is used to derive DEKs, which are the keys that are used to
     encrypt each block of data written to disk.
 
-- When you configure your key in Key Vault and reference it in the
-    *Cluster* resource, Azure Storage wraps the AEK with your KEK in
-    Azure Key Vault.
+- When you configure your key in Key Vault and reference it in the *Cluster* resource, the Azure Storage sends requests to your Azure Key Vault to wrap and unwrap the AEK to perform data encryption and decryption operations.
 
 - Your KEK never leaves your Key Vault and in the case of an HSM key,
     it never leaves the hardware.
@@ -101,10 +99,6 @@ The following rules apply:
     *Cluster* resource to authenticate and access to Azure Key Vault via
     Azure Active Directory.
 
-- For read/write operations, Azure Storage sends requests to Azure Key
-    Vault to wrap and unwrap the AEK to perform encryption
-    and decryption operations.
-
 ## CMK provisioning procedure
 
 For Application Insights CMK configuration, follow the Appendix content for steps 3 and 6.
@@ -403,12 +397,8 @@ encryption key and once accessed, data ingestion and query resume within
 
 ## CMK (KEK) rotation
 
-Rotation of CMK requires explicit update of the *Cluster* resource with
-the new Azure Key Vault Key version. To update Azure Monitor with your
-new key version, follow the instructions in "Update *Cluster* resource
-with *Key identifier* details" step.
-
-If you update your key in Key Vault and don't update the new *Key identifier* details in the *Cluster* resource*, Azure Monitor Storage will keep using your previous key.
+Rotation of CMK requires explicit update of the *Cluster* resource with the new key version in Azure Key Vault. To update Azure Monitor with your new key version, follow the instructions in "Update *Cluster* resource with Key identifier details" step. If you update your key version in Key Vault and don't update the new Key identifier details in the *Cluster* resource, Azure Monitor Storage will keep using your previous key.
+All your data is accessible after the key rotation operation including data ingested before the rotation and after it, since all data remains encrypted by the Account Encryption Key (AEK) while it’s now being encrypted by your new Key Encryption Key (KEK) version.
 
 ## Limitations and constraints