Envelope Encryption with KEK Architecture

For an additional layer of security, you can use a Key Encryption Key (KEK) to wrap the disk encryption secret before it is stored in the vault. This envelope encryption ensures that the secret is protected even if the vault itself is accessed. Azure Disk Encryption only supports RSA keys and does not allow Elliptic Curve keys for this purpose. While 2048-bit keys are standard, Windows Server 2022 and Windows 11 require 3072-bit or 4096-bit keys. Managing KEKs allows for easier key rotation without needing to re-encrypt the entire disk. All KEK and secret URLs must be versioned to meet Azure's strict security requirements.