"code":"NotSupported","message":"Azure Disk Encryption extension version '1.1 ' without AAD client/secret is not supported on VMs previously encrypted with AAD client/secret."

Question

I am getting this error when I try to enable disk encryption in my Azure VM -

I checked the other thread which answer this but it is not solving the problem. This is the first time ADE is being enabled on this VM and I am not aware if this was encrypted before using client id. The VM has a system assigned managed identity which was already given access to "Get" and "List on keyvault. " Keyvault and VM are in same subscription. I tried to rotate the key but it didn't help. Please help.

Answer 1

Hi,

I think the version 1.1 is an old version extension you will need latest one and if this is the new VM you will need to upgrade this - Check here - https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/azure-disk-enc-windows

Hope this helps.

JS

==

Please Accept the answer if the information helped you. This will help us and others in the community as well.

Answer 2

Thanks @JimmySalian-2011 for answering but when I add the extension in my code it doesn't have any type "AzureDiskEncryption". I am using latest API for Azure VM and for this extension, please check below screenshot -

I tried to add manually but there also I am unable to find this extension.

Answer 3

Thanks @JimmySalian-2011 but I am unable to find any extension type in ARM which is "AzureDiskEncryption". I tried to add manually but in portal also there is no such extension. I am using latest API for Azure VM and for the Extension.

Answer 4

@MILIND Welcome to Microsoft Q&A Forum, Thank you for posting your query here!
Adding more information to the above response!
How are you trying to encrypt the AZURE VM?

Can I migrate VMs that were encrypted with an Azure AD app to encryption without an Azure AD app?

Currently, there isn't a direct migration path for machines that were encrypted with an Azure AD app to encryption without an Azure AD app. Additionally, there isn't a direct path from encryption without an Azure AD app to encryption with an AD app.

 When ADE with AAD is enabled , unfortunately there isn't a way to convert this to ADE without AAD.
You can refer below link for migrate ADE from with AAD version to without AAD version,:

How to upgrade Azure Disk Encryption on a disk - Azure Virtual Machines | Microsoft Docs 
Azure Disk Encryption with Azure AD for Windows VMs (previous release) - Azure Virtual Machines | Microsoft Docs

Please let us know if you have any further queries. I’m happy to assist you further. 

---

 Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.