You have an Azure subscription that contains an Azure Data Factory version 2 (V2) data factory named df1. DF1 contains a linked service. You have an Azure Key vault named vault1 that contains an encryption kay named key1. You need to encrypt df1 by using key1. What should you do first?

To enable customer-managed key (CMK) encryption on an existing Azure Data Factory, the factory must be completely empty. This is a one-time setup requirement. All existing resources, which include linked services, pipelines, datasets, and data flows, must be removed before you can configure the data factory to use a key from Azure Key Vault. Therefore, the first action required is to remove the existing linked service from df1.

A. Disable purge protection on vault1. This is incorrect. To use a key from Azure Key Vault for CMK encryption in Data Factory, both soft delete and purge protection must be enabled on the key vault.
C. Create a self-hosted integration runtime. This is incorrect. A self-hosted integration runtime is a compute infrastructure for data movement and is not a prerequisite for configuring factory-level encryption with a customer-managed key.
D. Disable soft delete on vault1. This is incorrect. Soft delete is a mandatory prerequisite and must be enabled on the Azure Key Vault to protect against accidental key deletion and ensure data recoverability.

1. Microsoft Learn. (2023). Encrypt Azure Data Factory with customer-managed keys.

Section: Important

Content: "To enable customer-managed key

your Azure Data Factory V2 must be empty. You must remove all resources (for example

linked services

pipelines

and data flows) before you enable the key." This directly supports the correct answer (B).

2. Microsoft Learn. (2023). Encrypt Azure Data Factory with customer-managed keys.

Section: Prerequisites

Content: "The key vault must have soft delete and purge protection enabled." This statement confirms that options A and D are incorrect as they suggest disabling these features.