Key auto-rotation not compatible with Azure Disk Encryption

Question

Hi all,

on
https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-key-vault?tabs=azure-portal#azure-disk-encryption-and-auto-rotation
it is said that:
Although Azure Key Vault now has key auto-rotation, it isn't currently compatible with Azure Disk Encryption. Specifically, Azure Disk Encryption will continue to use the original encryption key, even after it has been auto-rotated.

If we create a Key Encryption Key (KEK) for an additional layer of security for Azure Disk Encryption (ADE) and enable auto-rotation for this KEK, will the new version of this KEK after auto rotation automatically be used for wrapping the current ADE Bitlocker Encryptions keys (BEK)?

kind regards
Nick

Answer 1

Hello @Anonymous

You can rotate the KEK by calling the command above

az vm encryption enable -n vmname -g rsgrp --key-encryption-key kek --disk-encryption-keyvault keyvault-name --volume-type ALL --encrypt-format-all  

every time when you need a newer version of the KEK.
Doing so, secret of type Wrapped BEKs in addition to existing one is added for VM.

https://learn.microsoft.com/en-us/answers/questions/763816/rotating-ade-kek-adds-two-new-secrets-wrapped-beks.html
https://github.com/MicrosoftDocs/azure-docs/issues/40707