The AZ-500 exam has been retired
It was retired on August 31, 2026. It was replaced by SC-500 (Microsoft Cloud and AI Security Engineer). Go to the SC-500 study guide →
Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.
4.1.4. Disk Encryption Options
💡 First Principle: Disk encryption protects data at rest. Azure provides multiple encryption options with different key management approaches.
Scenario: Your compliance requirements mandate customer-managed encryption keys and encryption of temporary disks.
Disk Encryption Comparison
| Type | Encrypts | Key Management | Temp Disk |
|---|---|---|---|
| Server-Side Encryption (SSE) | OS + Data disks | Platform or customer-managed | No |
| Azure Disk Encryption (ADE) | OS + Data disks | Customer-managed (Key Vault) | Yes |
| Encryption at Host | All disks + temp + cache | Platform or customer-managed | Yes |
| Confidential Disk Encryption | OS disk (VM-isolated key) | VM-specific | Yes |
⚠️ Exam Trap: Assuming SSE encrypts temporary disks. Server-Side Encryption (the default) does not encrypt temp disks or cache. Use Encryption at Host or ADE for comprehensive encryption.
Enroll to unlock the 5 practice questions written for this section, so you can test what you just read while it is fresh.
Enroll to unlock the 3 flashcards for this section and review them on a spaced-repetition schedule.
Written byAlvin Varughese
Founder•20 professional certifications