diff --git a/config_schema.json b/config_schema.json
index 8885822ac..d2235f74a 100644
--- a/config_schema.json
+++ b/config_schema.json
@@ -51,6 +51,14 @@
           "description": "The Azure subscription ID for all resources.",
           "type": "string",
           "pattern": "^[{]?[0-9a-fA-F]{8}-([0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}[}]?$"
+        },
+        "encryption_kv_name": {
+          "description": "Name of Key Vault for encryption keys.",
+          "type": "string"
+        },
+        "external_key_store_id": {
+          "description": "ID of external Key Vault to store CMKs.",
+          "type": "string"
         }
       },
       "required": [
@@ -96,6 +104,10 @@
         "custom_domain": {
           "description": "Custom domain name.",
           "type": "string"
+        },
+        "enable_cmk_encryption": {
+          "description": "Enables customer-managed key encryption for all supported resources.",
+          "type": "boolean"
         }
       }
     },