
1 - Configure a service endpoint for the storage account.
2 - Generate an encryption key.
3 - Enable encryption that uses customer-managed keys.
Explanation:
References:
https://docs.microsoft.com/en-us/azure/storage/common/storage-encryption-keys-portal
https://docs.microsoft.com/en-us/azure/key-vault/key-vault-hsm-protected-keys