Overview of Azure Disk Encryption
Azure Disk Encryption is a security feature that protects data at rest on virtual machines by encrypting both operating system and data disks. It uses BitLocker for Windows machines and DM-Crypt for Linux machines to provide volume encryption. The encryption keys are managed through Azure Key Vault, which must be located in the same region and subscription as the virtual machines you want to protect. This regional alignment is a critical prerequisite for successful deployment, because the encryption process requires the Key Vault and VM to communicate without crossing regional boundaries.
Setting Up Azure Key Vault
Before you can encrypt any virtual machine, you must create an Azure Key Vault to store your encryption keys. The vault acts as a cryptographic key management system that protects sensitive secrets using FIPS-validated hardware security modules. When creating the vault, you must enable the --enabled-for-disk-encryption parameter so that the Azure Disk Encryption extension can retrieve keys during the boot process.
For managed disks, it is mandatory to enable both soft-delete and purge protection on the Key Vault. Soft-delete retains deleted keys for a default period of 90 days, allowing recovery if keys are accidentally removed. Purge protection ensures that a deleted key cannot be permanently erased until the retention period expires, preventing permanent data loss from accidental deletion.
Access Policies and Permissions
Configuring the correct access policies is a critical prerequisite for allowing the Azure platform to interact with your encryption secrets. You must specifically enable the vault for volume encryption, and you may need to grant access to Azure Virtual Machines for deployment and Azure Resource Manager for template-based workflows. Without these advanced permissions, the encryption process will fail because the platform cannot access the necessary secrets to decrypt the disk.
Encrypting Virtual Machines
Administrators can enable encryption using Azure CLI, Azure PowerShell, or Resource Manager templates. The Azure CLI uses the az vm encryption enable command, while PowerShell uses the Set-AzVMDiskEncryptionExtension cmdlet. Before starting the encryption process, it is mandatory to create a snapshot or backup of the virtual machine to prevent data loss during the encryption phase.
When encrypting Linux virtual machines, the EncryptFormatAll feature can be used for data disks, which formats and encrypts all data volumes. This feature must be used with caution to avoid accidental data erasure. Unlike Windows, disabling encryption on a Linux OS disk is not supported once it has been applied. During the encryption of a Linux OS volume, the virtual machine should be considered unavailable to prevent file access issues that could block the process.
Key Encryption Key (KEK) Management
For an additional layer of security, you can use a Key Encryption Key (KEK) to wrap the disk encryption secret before it is stored in the vault. This envelope encryption ensures that the secret is protected even if the vault itself is accessed. Azure Disk Encryption only supports RSA keys and does not allow Elliptic Curve keys for this purpose. While 2048-bit keys are standard, Windows Server 2022 and Windows 11 require 3072-bit or 4096-bit keys. Managing KEKs allows for easier key rotation without needing to re-encrypt the entire disk. All KEK and secret URLs must be versioned to meet Azure's strict security requirements.
StudyCerts
StudyCerts