There is a command group 'az_storage_account_encryption scope'. This group of commands could 'manage encryption scope for a storage account'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_storage_account_encryption scope_update'.The syntax is: az storage account encryption-scope update --account-name
                                           --name
                                           [--key-source {microsoft.keyvault, microsoft.storage}]
                                           [--key-uri]
                                           [--resource-group]
                                           [--state {disabled, enabled}]. The 1th example of the child command would be to use it to 'update an encryption scope key source to microsoft storage', the syntax is: az storage account encryption-scope update --name myencryption -s Microsoft.Storage --account-name mystorageaccount -g MyResourceGroup. The 2th example of the child command would be to use it to 'create an encryption scope within storage account based on microsoft keyvault key source', the syntax is: az storage account encryption-scope update --name myencryption -s Microsoft.KeyVault -u "https://vaultname.vault.azure.net/keys/keyname/1f7fa7edc99f4cdf82b5b5f32f2a50a7" --account-name mystorageaccount -g MyResourceGroup. The 3th example of the child command would be to use it to 'disable an encryption scope within storage account', the syntax is: az storage account encryption-scope update --name myencryption --state Disabled --account-name mystorageaccount -g MyResourceGroup. The 4th example of the child command would be to use it to 'enable an encryption scope within storage account', the syntax is: az storage account encryption-scope update --name myencryption --state Enabled --account-name mystorageaccount -g MyResourceGroup. The parameter '--account-name' is required. It is used to the storage account name.. The parameter '--name -n' is required. It is used to the name of the encryption scope within the specified storage account.. The parameter '--key-source -s' is optional. the provider for the encryption scope.. The parameter '--key-uri -u' is optional. the object identifier for a key vault key object. when applied, the encryption scope will use the key referenced by the identifier to enable customer-managed key support on this encryption scope.. The parameter '--resource-group -g' is optional. name of resource group. you can configure the default group using `az configure --defaults group=<name>`.. The parameter '--state' is optional. change the state the encryption scope. when disabled, all blob read/write operations using this encryption scope will fail.. 