Skip to content

Encryption with your own key for a self-hosted deployment

By default, Azure encrypts the BI Pixie storage and Event Hubs with Microsoft-managed keys, and that suits most organizations. When you deploy BI Pixie on Azure, the Encryption tab can instead encrypt the storage accounts with a key you hold in your own Azure Key Vault. This covers the data lake that holds your events and the storage that the Function Apps run from.

Who this is for

This option is for organizations whose policy requires data at rest to be encrypted with a key they control and can revoke. If your policy has no such rule, keep Microsoft-managed keys: there is nothing to prepare and nothing extra to pay.

The choice is made when the storage accounts are created, so the Encryption tab appears only when the deployment creates new Function Apps, from version 1.1.0 of the deployment template.

What it costs

Encrypting the storage accounts with your own key adds the cost of your Key Vault and its key operations, usually small. Encrypting Event Hubs as well is the expensive part: it needs the Event Hubs Premium tier, which costs about 10 times the Standard tier. Every cost on this page is an Azure charge in your own subscription, billed to you by Microsoft, not by BI Pixie.

What changes for viewers

Nothing, while the key is available. Viewers are tracked exactly as with Microsoft-managed keys. What happens while the key is unavailable is explained under Revoking the key.

What to prepare

  • A Key Vault or Managed HSM with soft delete and purge protection turned on, and an RSA key in it. If the vault has a firewall, allow trusted Microsoft services to bypass it.
  • A user-assigned managed identity in the same tenant.
  • The Key Vault Crypto Service Encryption User role for that identity on the key. If the vault uses access policies instead of Azure role-based access control, give the identity the Get, Wrap Key and Unwrap Key key permissions.

In the Encryption tab

  1. Select Encrypt with my own key (customer-managed key).
  2. In Key URI, enter the key identifier, for example https://myvault.vault.azure.net/keys/bipixie-key. When you leave out the version, storage uses the latest version of the key, so a key rotation needs no change to BI Pixie.
  3. In User-assigned managed identity resource ID, enter the full resource ID of the identity.
  4. Optionally, select Also encrypt Event Hubs with my key. The namespace is created on the Premium tier with one processing unit. This option is offered only when the deployment creates a new Event Hubs namespace.

What stays on Microsoft-managed keys

Without the Event Hubs option, events wait in a Standard Event Hubs namespace under Microsoft-managed keys for the retention period you selected (1 to 7 days) before they reach your storage. Application Insights and Log Analytics, when you use them, keep their own encryption settings. An existing storage account or Event Hubs namespace that you point the deployment to keeps the encryption it already has.

Revoking the key

If you disable or delete the key, or remove the identity’s access to it, Azure can no longer decrypt the storage. The Function Apps that run from that storage stop working, so new events are no longer recorded. Your Power BI reports keep working for their viewers, but their activity is not captured while the key is unavailable.

Usage events that viewers send while the key is unavailable are refused when they arrive. They are not held for later, so they are lost. Events already waiting in Event Hubs are lost once the retention period passes, unless access to the key is restored first. When you restore access, the deployment resumes and processes the events that are still within the retention period.

How long tracking takes to show again. After access to the key is restored and the Function Apps restart, new usage events can take about 10 minutes to appear in your storage. Usage events that viewers send during those minutes are not lost. They reach your storage a few minutes late.

What it does not do

A customer-managed key controls whether Azure can decrypt your data at rest. It does not limit what the deployed BI Pixie Function Apps, or anyone with access to your subscription, can read while the key is available. If your requirement is that data stays under your control in Microsoft Fabric, the answer for BI Pixie Cloud and the BI Pixie Workload is OneLake data residency, not this option.

After the deployment

There is nothing more to set up in BI Pixie. The deployment needs the key, the identity and its role for as long as it runs, and the key can be rotated in Key Vault as your policy requires. When the Key URI was entered without a version, storage follows each new version of the key.