You're a great admin... on-prem. Now, become a great admin in the cloud and prove it by passing the Microsoft Certified: Azure Administrator Associate exam!
Azure Disk Encryption is a security feature that protects data at rest on virtual machines by encrypting both operating system and data disks. It uses BitLocker for Windows machines and DM-Crypt for Linux machines to provide volume encryption. The encryption keys are managed through Azure Key Vault, which must be located in the same region and subscription as the virtual machines you want to protect. This regional alignment is a critical prerequisite for successful deployment, because the encryption process requires the Key Vault and VM to communicate without crossing regional boundaries.
Before you can encrypt any virtual machine, you must create an Azure Key Vault to store your encryption keys. The vault acts as a cryptographic key management system that protects sensitive secrets using FIPS-validated hardware security modules. When creating the vault, you must enable the --enabled-for-disk-encryption parameter so that the Azure Disk Encryption extension can retrieve keys during the boot process.
For managed disks, it is mandatory to enable both soft-delete and purge protection on the Key Vault. Soft-delete retains deleted keys for a default period of 90 days, allowing recovery if keys are accidentally removed. Purge protection ensures that a deleted key cannot be permanently erased until the retention period expires, preventing permanent data loss from accidental deletion.
Configuring the correct access policies is a critical prerequisite for allowing the Azure platform to interact with your encryption secrets. You must specifically enable the vault for volume encryption, and you may need to grant access to Azure Virtual Machines for deployment and Azure Resource Manager for template-based workflows. Without these advanced permissions, the encryption process will fail because the platform cannot access the necessary secrets to decrypt the disk.
Administrators can enable encryption using Azure CLI, Azure PowerShell, or Resource Manager templates. The Azure CLI uses the az vm encryption enable command, while PowerShell uses the Set-AzVMDiskEncryptionExtension cmdlet. Before starting the encryption process, it is mandatory to create a snapshot or backup of the virtual machine to prevent data loss during the encryption phase.
When encrypting Linux virtual machines, the EncryptFormatAll feature can be used for data disks, which formats and encrypts all data volumes. This feature must be used with caution to avoid accidental data erasure. Unlike Windows, disabling encryption on a Linux OS disk is not supported once it has been applied. During the encryption of a Linux OS volume, the virtual machine should be considered unavailable to prevent file access issues that could block the process.
For an additional layer of security, you can use a Key Encryption Key (KEK) to wrap the disk encryption secret before it is stored in the vault. This envelope encryption ensures that the secret is protected even if the vault itself is accessed. Azure Disk Encryption only supports RSA keys and does not allow Elliptic Curve keys for this purpose. While 2048-bit keys are standard, Windows Server 2022 and Windows 11 require 3072-bit or 4096-bit keys. Managing KEKs allows for easier key rotation without needing to re-encrypt the entire disk. All KEK and secret URLs must be versioned to meet Azure's strict security requirements.
A system architecture diagram showing how Azure Disk Encryption generates a disk encryption secret, wraps it with a Key Encryption Key (KEK) in Azure Key Vault, and uses the wrapped secret to encrypt VM disks.
Monitoring the encryption process is essential for verifying compliance and resolving operational issues. The Get-AzVmDiskEncryptionStatus cmdlet or the az vm encryption show command provides the current state of the disks. Common restrictions include the lack of support for Basic tier VMs, ephemeral OS disks, and certain high-performance NVMe storage types. If encryption fails, administrators should check network connectivity to the Azure Key Vault and verify that the vault is enabled for disk encryption access.
Before enabling encryption, you must ensure that the virtual machine has access to specific network endpoints for Azure storage and Key Vault. On Linux systems, disks must be mounted in the /etc/fstab file using a persistent block device name with the "nofail" option to ensure they remain accessible after encryption. You should stop all services and processes that could be writing to mounted data disks before starting encryption to prevent failures.
Prepare and test your skills
Prepare and test your skills
The Azure Key Vault must be in the same region and subscription as the virtual machines you want to protect, and it must have the `--enabled-for-disk-encryption` parameter enabled. For managed disks, it is mandatory to enable both soft-delete and purge protection on the Key Vault.
A Key Encryption Key (KEK) provides an additional layer of security by wrapping the disk encryption secret before it is stored in the vault, using envelope encryption. Azure Disk Encryption only supports RSA keys, not Elliptic Curve keys, and Windows Server 2022 and Windows 11 require 3072-bit or 4096-bit keys.
For Windows virtual machines, encryption on the OS disk can be disabled, but for Linux virtual machines, disabling encryption on the OS disk is not supported once it has been applied. During encryption of a Linux OS volume, the virtual machine should be considered unavailable to prevent file access issues.
StudyCerts
StudyCerts