diff --git a/specification/storage/resource-manager/Microsoft.Storage/stable/2021-08-01/storage.json b/specification/storage/resource-manager/Microsoft.Storage/stable/2021-08-01/storage.json
index 7b8c59abb582..e4c7aacd736f 100644
--- a/specification/storage/resource-manager/Microsoft.Storage/stable/2021-08-01/storage.json
+++ b/specification/storage/resource-manager/Microsoft.Storage/stable/2021-08-01/storage.json
@@ -2530,13 +2530,13 @@
       "properties": {
         "enabled": {
           "type": "boolean",
-          "description": "A boolean indicating whether or not the service encrypts the data as it is stored."
+          "description": "A boolean indicating whether or not the service encrypts the data as it is stored. Encryption at rest is enabled by default today and cannot be disabled."
         },
         "lastEnabledTime": {
           "readOnly": true,
           "type": "string",
           "format": "date-time",
-          "description": "Gets a rough estimate of the date/time when the encryption was last enabled by the user. Only returned when encryption is enabled. There might be some unencrypted blobs which were written after this time, as it is just a rough estimate."
+          "description": "Gets a rough estimate of the date/time when the encryption was last enabled by the user. Data is encrypted at rest by default today and cannot be disabled."
         },
         "keyType": {
           "type": "string",
@@ -2948,7 +2948,7 @@
         },
         "encryption": {
           "$ref": "#/definitions/Encryption",
-          "description": "Not applicable. Azure Storage encryption is enabled for all storage accounts and cannot be disabled."
+          "description": "Encryption settings to be used for server-side encryption for the storage account."
         },
         "networkAcls": {
           "$ref": "#/definitions/NetworkRuleSet",
@@ -3533,7 +3533,7 @@
         "encryption": {
           "$ref": "#/definitions/Encryption",
           "readOnly": true,
-          "description": "Gets the encryption settings on the account. If unspecified, the account is unencrypted."
+          "description": "Encryption settings to be used for server-side encryption for the storage account."
         },
         "accessTier": {
           "readOnly": true,
@@ -3850,7 +3850,7 @@
         },
         "encryption": {
           "$ref": "#/definitions/Encryption",
-          "description": "Provides the encryption settings on the account. The default setting is unencrypted."
+          "description": "Not applicable. Azure Storage encryption at rest is enabled by default for all storage accounts and cannot be disabled."
         },
         "sasPolicy": {
           "$ref": "#/definitions/SasPolicy",
@@ -4833,9 +4833,6 @@
             "$ref": "#/definitions/LocalUser"
           },
           "description": "The local users associated with the storage account."
-        },
-        "systemData": {
-          "$ref": "../../../../../common-types/resource-management/v2/types.json#/definitions/systemData"
         }
       },
       "description": "List storage account local users."
@@ -4882,9 +4879,11 @@
           "description": "A unique Security Identifier that is generated by the server."
         },
         "sharedKey": {
+          "x-ms-secret": true,
           "$ref": "#/definitions/SharedKey"
         },
         "sshPassword": {
+          "x-ms-secret": true,
           "readOnly": true,
           "type": "string",
           "description": "Auto generated password by the server for SSH authentication if hasSshPassword is set to true on the creation of local user."