Explanation "Customer-managed keys require an additional billable service, Azure Key Vault, which can be in a different region, but under the same subscription, as Azure Cognitive Search. Enabling CMK encryption will increase index size and degrade query performance." same document also lists Azure Key Vault as a requirement: https://docs.microsoft.com/en-us/azure/search/search-security-overview#data-protection