Azure Storage now supports customer-managed keys using a key vault on a different Azure Active Directory tenant.