We have a requirement to store some sensitive data of the user in Azure blob. We want to make sure that the data is accessible only to applications running in User's context. (The subscription owner or the contributors should also be restricted from viewing the data).
The options we have now is,
Restrict the blob to MSI under Azure firewall (MSI audience and app validations targeted to RBAC applications - say X azure funtions' appid) & Setup an alert if someone is trying to elevate themselves for the Storage's IAM
Create a master key in Azure key vault. Create a RBAC azure funtion to generate user distributed keys (Hash if master_key + user_id). Restrict azure key vault to MSI of this Azure function. Other client funtions that are running in user context can use this distrubuted user key to encrypt and store the data (which can be decrypted only by RBAC apps) & Setup an alert if someone is trying to elevate themselves for the KeyVault's IAM.
Both these approaches use reactive alert if someone tries to peek other user data. During our reviews, few folks suggested to create a random private key and store in one drive of the user to ensure complete anonymity - but our app can't get read-write access to One drive of user.
Is there any other way this problem can be solved? Is there a azure service that can generate n store private keys for user ( similar to HSM but a key unique to user, accessible only to that user context).
Thanks in advance