I have an Azure VM. It has one OS disk and one data disk. If I go to its disks in Azure portal, I see encryption enabled with a platform-managed key
But when I run the below az command
az vm encryption show --name vm1 --resource-group rg1
Azure Disk Encryption is not enabled
so my question is are these two different encryptions? How do I enable Azure disk encryption using the platform managed key on the Azure portal? My goal is to enable encryption at the host.
Thanks in advance.
Azure Disk Encryption is not enabled,My goal is to enable encryption at the host.
Platform-managed disk encryption: This encryption is enabled at the platform level and is applied to the OS disk of the Virtual Machine. When you see "Encryption Enabled" on the disks in the Azure portal
, it means that platform-managed disk encryption
is turned on for those disks. This encryption is managed by Azure
and uses a platform-managed key
.
Azure Disk Encryption: This is a specific feature in Azure that allows you to enable encryption at the OS level for virtual machines. It uses Azure Key Vault to store the encryption keys. When you run the az vm encryption show
command, it checks whether Azure Disk Encryption is enabled for the virtual machine's OS disk.
Enabling platform-managed disk encryption at the platform level (as shown in the Azure portal)
does not automatically enable Azure Disk Encryption for the VM's OS disk. These are separate features.
When I check the Disk encryption
status before enabling ADE
for the VM OS Disk
, I also got the same result as you.
Result
To enable Azure Disk Encryption for the VM's OS
disk. follow the below steps.
Create an Azure Key Vault
with the required permissions, and make sure to include the --key-permissions wrapKey permission to enable disk encryption
.
Once the Key Vault
is created, enable Key Vault for disk encryption using the below command.
az keyvault update --name "demovaulttest-test" --resource-group 'Imran' --enabled-for-disk-encryption "true"
key vault
using the below command.az vm encryption enable --resource-group <rg-Name> --name <VM-Name> --disk-encryption-keyvault demovaulttest-test --volume-type ALL
Output: