Azure Disk Encryption (ADE) protects data at rest on virtual machines by using BitLocker on Windows and DM-Crypt on Linux to encrypt both OS and data disks. ADE integrates directly with Azure Key Vault to store and manage encryption keys and secrets. Administrators can choose customer-managed keys or add a Key Encryption Key (KEK) for an extra security layer, allowing key rotation and separation of duties. Group policy settings and BitLocker external key protectors must be correctly configured to prevent deployment failures, as ADE depends on these policies to apply encryption successfully.
Encryption at host extends the always-on Server-Side Encryption (SSE) to components that SSE alone does not cover. When enabled, it encrypts temp disks for ephemeral storage, disk caches for read/write performance layers, and data flows between compute and storage nodes. This provides end-to-end encryption for every storage piece attached to the VM. Customers can use either platform-managed keys or customer-managed keys stored in a Disk Encryption Set (DES) to meet compliance needs, with the encryption boundary now covering the entire host.
Confidential disk encryption adds a hardware-backed layer using Azure Confidential Compute. The OS disk is encrypted with keys that are locked to an attested VM state via a virtual TPM, bypassing the hypervisor and host OS entirely. This approach gives enhanced key protection and isolated execution for sensitive workloads, making it suitable for scenarios that demand the highest data isolation. Currently, temporary disk support for confidential VMs is in preview, so its availability depends on the VM series chosen.
To confirm that encryption is correctly applied and remains compliant, use Azure Policy definitions to audit or enforce encryption at host on VMs and scale sets, SSE with customer-managed keys, and confidential OS disk encryption. Microsoft Defender for Cloud and Key Vault logging provide continuous visibility into encryption status, health, and key access attempts. Together these tools ensure that every disk layer stays protected and that any drift from policy is detected early, maintaining the organization’s security posture.
Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Prepare and test your skills
Prepare and test your skills
Encryption at host encrypts temporary disks used for ephemeral storage, disk caches for performance layers, and data flows between compute and storage nodes. This extends Server-Side Encryption (SSE) to provide end-to-end encryption for every storage piece attached to the virtual machine.
Azure Disk Encryption (ADE) protects data at rest by using BitLocker on Windows and DM-Crypt on Linux to encrypt both OS and data disks. It integrates directly with Azure Key Vault to manage encryption keys and secrets, supporting customer-managed keys or an optional Key Encryption Key (KEK) for additional security.
Confidential disk encryption uses Azure Confidential Compute to encrypt the OS disk with keys locked to an attested virtual machine state through a virtual TPM. This hardware-backed approach bypasses both the hypervisor and host operating system to deliver isolated execution and enhanced key protection for sensitive workloads.
Administrators can use Azure Policy definitions to audit or enforce encryption at host, Server-Side Encryption (SSE) with customer-managed keys, and confidential OS disk encryption. Furthermore, Microsoft Defender for Cloud and Azure Key Vault logging supply continuous monitoring of encryption status, health, and key access attempts.
StudyCerts
StudyCerts