Ive been looking for few weeks now on the best way to store my encryption keys when i host my application within Azure - although ive read many articles/forums etc. im still completely lost and would just like some clarification. Here is a quick overview of my application.

A user will create a group which many people can be invited to and once in a group you can then upload documents to that group so that people can view them, now what i am wanting is for every document which has been uploaded to be encrypted with AES and stored in my database.

but where do i store the IV and key while in Azure? I was thinking about setting up another database within Azure which will only store my IV/Key and maybe the DocumentId to link back to it.

Is that the best way?

My web app will be created in .NET