4.1.3.1. Configure Azure Disk Encryption

4.1.3.1. Configure Azure Disk Encryption

💡 First Principle: Azure Disk Encryption protects data at rest by encrypting VM disks using industry-standard technologies, ensuring data confidentiality even if the underlying storage is compromised, with keys securely managed in Azure Key Vault.

Scenario: An existing Windows VM hosts a database containing sensitive customer information. Your organization's security policy requires volume encryption inside the guest OS, with the keys held in a key store you control. You need to encrypt the VM's OS and data disks and manage the keys securely.

What It Is: ADE is a feature that encrypts the OS and data disks attached to Azure Virtual Machines. For Windows, ADE uses BitLocker; for Linux, it uses DM-Crypt.

Status: Azure Disk Encryption is scheduled for retirement on September 15, 2028, and Microsoft says to use encryption at host for new VMs (covered later in this section). ADE is still on the AZ-104 skills outline, so know how it works, and know that ADE-enabled VMs must migrate to encryption at host before that date.

Key Vault Integration: ADE integrates with Azure Key Vault, which securely stores and manages the encryption keys. This integration centralizes key management and allows you to maintain control over your encryption keys.

Benefits of ADE:

• Data Protection: Encrypts data at rest, supporting compliance with regulations (e.g., GDPR, HIPAA).
• Security: Prevents unauthorized access to disk data, even if disks are detached from the VM.
• Simplified Key Management: Azure Key Vault handles key storage, access policies, and lifecycle management.

Practical Implementation: Enabling ADE with PowerShell

# Define variables
$keyVaultName = "MyKeyVault"
$vmName = "MySecureVM"
$resourceGroupName = "MyResourceGroup"

# Enable encryption
Set-AzVMDiskEncryptionExtension -ResourceGroupName $resourceGroupName -VMName $vmName -DiskEncryptionKeyVaultUrl (Get-AzKeyVault -VaultName $keyVaultName).VaultUri -DiskEncryptionKeyVaultId (Get-AzKeyVault -VaultName $keyVaultName).ResourceId -VolumeType All

Visual: Azure Disk Encryption (ADE) Workflow

⚠️ Common Pitfall: Not backing up the Azure Key Vault that stores the encryption keys. If the Key Vault is lost or the keys are deleted without a backup, the encrypted disks will be unrecoverable.

Key Trade-Offs:

• Security vs. Performance: Disk encryption can introduce a minor performance overhead, though this is often negligible for modern VM sizes and disk types.

Encryption at Host: The Recommended Option for New VMs

💡 First Principle: The strongest place to encrypt VM data is where it is first written, on the physical host, so that temporary disks, caches, and the path to storage are covered without the guest operating system doing any of the work.

Scenario: A new analytics VM writes intermediate files to its temporary disk. The auditor asks that the temp disk and the disk caches be encrypted at rest, and the performance team won't accept anything that consumes CPU inside the VM.

Why this matters now: Azure Disk Encryption is scheduled for retirement on September 15, 2028. Until then ADE keeps working, but Microsoft's guidance is to use encryption at host for new VMs and to migrate ADE-enabled VMs before that date.

What It Is: Encryption at host is a VM option that extends server-side encryption (SSE). The Azure server hosting your VM encrypts the data it stores (the temporary disk and the OS/data disk caches), and that data flows encrypted to the Storage service.

• Temporary disks and ephemeral OS disks are encrypted with platform-managed keys.
• OS and data disk caches use the same key type as their disk: platform-managed, or customer-managed through a disk encryption set.
• It doesn't use the VM's CPU and doesn't affect VM performance.

Comparing the Disk Encryption Options:

Practical Implementation: Enabling Encryption at Host (Azure CLI)

# 1. One-time, per subscription: register the feature, then wait for "Registered"
az feature register --namespace Microsoft.Compute --name EncryptionAtHost
az feature show --namespace Microsoft.Compute --name EncryptionAtHost

# 2a. New VM (platform-managed keys)
az vm create -g MyResourceGroup -n MyVM --image <image> --size <supported-size> --encryption-at-host

# 2b. Existing VM: deallocate first, then set the property and start the VM
az vm deallocate -g MyResourceGroup -n MyVM
az vm update -g MyResourceGroup -n MyVM --set securityProfile.encryptionAtHost=true
az vm start -g MyResourceGroup -n MyVM

In the portal, select Encryption at host on the Disks pane when you create the VM. Not every size supports it: sizes that do report the EncryptionAtHostSupported capability, and legacy sizes aren't supported.

Restrictions to know:

• It can't be enabled on VMs or scale sets that currently or ever had Azure Disk Encryption, and ADE can't be enabled on disks that use encryption at host. Microsoft publishes a migration procedure from ADE to encryption at host.
• Existing VMs must be deallocated and reallocated to be encrypted.
• On an existing scale set, only VMs created after you enable it are encrypted automatically.

⚠️ Exam Trap: Encryption at host isn't ADE under a new name. Nothing runs inside the guest (no BitLocker or DM-Crypt), and with platform-managed keys you don't need a key vault at all. A key vault and a disk encryption set come in only when you want customer-managed keys.

Reflection Question: How does configuring Azure Disk Encryption (integrating with Azure Key Vault for key management) fundamentally protect data at rest on Azure virtual machine disks, ensuring data cannot be accessed by unauthorized parties even if storage is compromised?