Encryption state between portal and CLI varies

Manuel 41 Reputation points
2020-06-12T22:16:34.357+00:00

I have activated Azure Disk Encryption for a Windows VM which did not have any data disks. I did so by selecting "Disks to encrypt: OS and data disks" in the Azure portal. The OS disk was then shown as "SSE with PMK & ADE" in the Azure portal.

After that I've added a data disk which I'd also like to encrypt using ADE. Now that disk has different encryption states shown:

  • Azure portal shows "SSE with PMK" (even the "Disks to encrypt" setting is set to "OS and data disks")
  • The CLI command "az vm encryption show" returns "code": "EncryptionState/encrypted" for that disk
  • Within the VM's BitLocker console the drive is also shown as "BitLocker on"

Is this an error in the Azure portal? And if so, is there a way to reinitalize that status to also get the "ADE" status in the portal?

Azure Disk Encryption
Azure Disk Encryption
An Azure service for virtual machines (VMs) that helps address organizational security and compliance requirements by encrypting the VM boot and data disks with keys and policies that are controlled in Azure Key Vault.
162 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sumarigo-MSFT 43,806 Reputation points Microsoft Employee
    2020-06-16T08:35:57.037+00:00

    @ Firstly, apologies for the delay in responding here and any inconvenience this issue may have caused.
    We are aware of this issue, our product engineering team is working on it. We will update you at the earliest

    Please don’t forget to "Accept the answer" wherever the information provided helps you, this can be beneficial to other community members.

  2. JamesTran-MSFT 36,461 Reputation points Microsoft Employee
    2020-09-16T23:26:41.17+00:00

    @Manuel
    You can follow the below steps to hopefully resolve your issue:

    1) Confirm your data disk is initialized and a drive letter is assigned to the disk. Also make sure your data disk is formatted as NTFS.
    2) Open up a CMD prompt run - "manage-bde -status"

    • Confirm all the drives (OS and Data Disk) show 100%, fully encrypted.
      25285-managebde.jpg

    No matter if the drives are at 0% or 100%, since you want all your disks to be encrypted. We can go ahead with step 3.

    3) Confirm you have a good backup/snapshot of your disks prior to running any encryption script.
    4) Run the sequence version encryption script, choosing to use either the BEK or KEK script.
    5) Confirm encryption status in the Azure Portal.
    6) Confirm encryption status on your VM using step 2.

    If you continue to run into issues, please let me know.
    Thank your for your time and patience throughout this issue!

    0 comments