Edit

Overview of managed disk encryption options

Several encryption types are available for your managed disks, including Azure Disk Encryption (ADE), server-side encryption (SSE), and encryption at host.

  • Azure Disk Storage server-side encryption (also referred to as encryption at rest or Azure Storage encryption) is always enabled. It automatically encrypts data stored on Azure managed disks (OS and data disks) when it persists data on the storage clusters. When you configure it with a disk encryption set (DES), it also supports customer-managed keys. It doesn't encrypt temp disks or disk caches. For full details, see Server-side encryption of Azure Disk Storage.

  • Encryption at host is a virtual machine option that enhances Azure Disk Storage server-side encryption. This option ensures that all temp disks and disk caches are encrypted at rest and flow encrypted to the storage clusters. For full details, see Encryption at host - End-to-end encryption for your VM data.

  • Confidential disk encryption binds disk encryption keys to the virtual machine's TPM and makes the protected disk content accessible only to the VM. The TPM and VM guest state are always encrypted in attested code by using keys released by a secure protocol that bypasses the hypervisor and host operating system. Confidential OS disk encryption protects the OS disk. You can also enable confidential temp disk encryption through an opt-in process. You can use encryption at host for other disks on a confidential VM in addition to confidential disk encryption. For full details, see DCasv5 and ECasv5 series confidential VMs.

  • Azure Disk Encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. ADE encrypts the OS and data disks of Azure virtual machines (VMs) inside your VMs by using the DM-Crypt feature of Linux or the BitLocker feature of Windows. ADE is integrated with Azure Key Vault to help you control and manage the disk encryption keys and secrets, with the option to encrypt by using a key encryption key (KEK). For full details, see Azure Disk Encryption for Linux VMs or Azure Disk Encryption for Windows VMs.

    Important

    Azure Disk Encryption is scheduled for retirement on September 15, 2028. Until that date, you can continue to use Azure Disk Encryption without disruption. On September 15, 2028, ADE-enabled workloads will continue to run, but encrypted disks will fail to unlock after VM reboots, resulting in service disruption.

    Use encryption at host for new VMs, or consider Confidential VM sizes with OS disk encryption for confidential computing workloads. All ADE-enabled VMs (including backups) must migrate to encryption at host before the retirement date to avoid service disruption. See Migrate from Azure Disk Encryption to encryption at host for details.

Encryption is part of a layered approach to security. Use it with other recommendations to secure virtual machines and their disks. For full details, see Compute security recommendations and Restrict import/export access to managed disks.

Comparison

The following table compares Disk Storage SSE, ADE, encryption at host, and confidential disk encryption.

  Azure Disk Storage server-side encryption Encryption at host Azure Disk Encryption Confidential disk encryption (for the OS disk only)
Encryption at rest (OS and data disks) ✅ ✅ ✅ ✅
Temp disk encryption ❌ ✅ Supported only with platform-managed keys ✅ ✅ Opt-in
Encryption of caches ❌ ✅ ✅ ✅
Data flows encrypted between compute and storage ❌ ✅ ✅ ✅
Customer control of keys ✅ When configured with DES ✅ When configured with DES ✅ When configured with KEK ✅ When configured with DES
HSM support Azure Key Vault Premium and Managed HSM Azure Key Vault Premium and Managed HSM Azure Key Vault Premium Azure Key Vault Premium and Managed HSM
Does not use your VM's CPU ✅ ✅ ❌ ❌
Works for custom images ✅ ✅ ❌ Does not work for custom Linux images ✅
Enhanced key protection ❌ ❌ ❌ ✅
Microsoft Defender for Cloud disk encryption status* Unhealthy Healthy Healthy Not applicable

Important

For confidential disk encryption, Microsoft Defender for Cloud doesn't currently have an applicable recommendation.

* Microsoft Defender for Cloud has the following disk encryption recommendations:

Next steps

  • Last updated on