Azure VM - Managed disk encryption in transit between VM and disk storage service ?

Søren Brandt (SOB) 1 Reputation point
2022-09-23T12:25:40.93+00:00

Normally, I would be inclined to assume that data are encrypted in transit between a VM and the managed disk storage service.

However, in [Enable end-to-end encryption using encryption at host][1], it is stated that “When you enable encryption at host, data stored on the VM host is encrypted at rest and flows encrypted to the Storage service.”

So how should I understand this statement? Does it mean that if I do not enable Encryption at Host or Azure Disk Encryption, then my data will be transmitted unencrypted between the VM and the managed disk storage service?

Azure Disk Encryption
Azure Disk Encryption
An Azure service for virtual machines (VMs) that helps address organizational security and compliance requirements by encrypting the VM boot and data disks with keys and policies that are controlled in Azure Key Vault.
162 questions
Azure Disk Storage
Azure Disk Storage
A high-performance, durable block storage designed to be used with Azure Virtual Machines and Azure VMware Solution.
575 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. SaiKishor-MSFT 17,201 Reputation points
    2022-09-26T23:16:41.047+00:00

    @Søren Brandt (SOB) Thank you for reaching out to Microsoft Q&A. I understand that you are having questions about Disk Encryption.

    Answering your question- Azure Disk Encryption provides end-to-end encryption for the OS disk, data disks, and the temporary disk, using a customer-managed key.

    • If your requirements include encrypting only data at rest with customer-managed key, then use Server-side encryption with customer-managed keys. You cannot encrypt a disk with both Azure Disk Encryption and Storage server-side encryption with customer-managed keys.

    Most Azure managed disks are encrypted with Azure Storage encryption, which uses server-side encryption (SSE) to protect your data and to help you meet your organizational security and compliance commitments. Azure Storage encryption automatically encrypts your data stored on Azure managed disks (OS and data disks) at rest by default when persisting it to the cloud. Disks with encryption at host enabled, however, are not encrypted through Azure Storage. For disks with encryption at host enabled, the server hosting your VM provides the encryption for your data, and that encrypted data flows into Azure Storage.

    So if you use, Azure Disk Encryption and Encryption at host, data flows encrypted between storage and compute and if you use Azure Disk Storage Server-Side Encryption at rest, it is not encrypted between storage and compute.

    Please also refer to this comparison to know more- https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-overview#comparison & this video for a Deep Dive into Disk Encryption- https://www.youtube.com/watch?v=EOXgzTqceok&t=1873s

    Hope this answers your questions. If not, please let me know and I can assist further. Thank you!
    Remember:

    Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

    Want a reminder to come back and check responses? Here is how to subscribe to a notification.

    0 comments