Has anybody enable azure encryption at host? What is the business impact of enabling this feature?

Question

Hello Everyone,

My requirement is to remediate one of the defender findings.

"Virtual Machines should encrypt temp disks and data flows between Compute and Storage resources"-- I believe this can be fixed by enabling azure encryption at host.

Can somebody please advise me what is the business impact of enabling this option in azure VMs?

Also I can see we can't perform azure disk encryption on disks that have enabled with VM encryption at host? so please advise me how does it effect there?

Looking forward for kind responses on this please.

Thank you.

Answer 1

@Maheswararaju P Thank you for reaching out to Microsoft Q&A. I understand that you are having questions regarding encryption of Temp disks and data flows between compute and storage resources. Answering your questions below:

• "Virtual Machines should encrypt temp disks and data flows between Compute and Storage resources"-- I believe this can be fixed by enabling azure encryption at host.

Azure Disk Encryption should help you with the above. Please refer to this thread that discusses a similar issue.

• Can somebody please advise me what is the business impact of enabling this option in azure VMs?

Can you explain further, what business impact you referring to? Downtime, costs?

• Also I can see we can't perform azure disk encryption on disks that have enabled with VM encryption at host? so please advise me how does it effect there?

When it comes to the effects, are you referring to the different ways the encryption is implemented?

With Encryption at Host, this is done at the Azure Server level, so the server that your VM is allocated to. Encryption at host encrypts your data from end-to-end. Encryption at host does not use your VM's CPU and doesn't impact your VM's performance. For more info.
Azure Disk Encryption (depending on your OS) leverages your VMs encryption features, such as BitLocker for Windows or DM Crypt for Linux, in order to provide volume encryption for the OS and data disks of the VM. For more info.

Hope this helps. Please let us know if you have any further questions and we will be glad to assist you further. Thank you!

Remember:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Want a reminder to come back and check responses? Here is how to subscribe to a notification.

Answer 2

@Maheswararaju P
Thank you for following up on this!

To help @SaiKishor-MSFT answer some of your questions:

When we go with Azure disk encryption, does it impact the VM CPU performance?

• Azure Disk Encryption (ADE) should not impact the VM CPU performance, ADE only uses your VMs CPU for DM-Crypt (Linux) or BitLocker (Windows) to encrypt your OS and data disks. ADE also requires your VM to have more than 2 GB of memory. For more info.

What is the business impact of enabling this option in Azure VMs? Existing VMs must be deallocated and reallocated in order to be encrypted, does this mean we can't enable Encryption at Host without doing deallocation of the VM?

• For Azure Disk Encryption, the downtime will be dependent on how much data is on your VMs OS disk, and how many data disks you plan to encrypt. For a more detailed explanation on downtime. There's also no charge for encrypting VM disks with Azure Disk Encryption, but there are charges associated with the use of Azure Key Vault. For more information see the Key Vault pricing page.
• I'm not too familiar with Encryption at Host, but from our Enable end-to-end using encryption at host documentation, the downtime is the time it takes to deallocate/re-allocate(start) your VM (which is required). Unlike ADE, Encryption at Host doesn't need to wait for the VM to boot up and for the encryption feature to run (DM-Crypt or BitLocker), since encryption is done at the actual server level (VM Host). Enabling azure disk encryption will encrypt the temp disks, and caches
  • Yes, enabling Azure Disk Encryption will encrypt the Temp Storage (disc), and when referring to the disc cache if that data is being stored on the VM within Temp Storage, it will be encrypted.
    
    BitLocker (lock icon) encrypting the OS and Temp Storage of a VM:

Additional Links:

Server-side encryption versus Azure disk encryption
Azure Disk Encryption for Windows VMs
Azure Disk Encryption for Linux VMs

I hope this helps!

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

---

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 3

@Maheswararaju P
Thank you for following up on this and I apologize for the delayed response!

Assume if it takes 30 minutes, does that mean for 30 minutes the VM will be down, or will it be functional and running as is.

• From my experience, your VM won't be down for the full 30 minutes. Usually, the VM will need to restart during the encryption process, but the downtime will be the time it takes for your VM to boot-up. During the encryption process, your VM will be running with BitLocker encrypting your drives.

Please provide me if there is any policy with effect deny, to prevent any VM that is going to be deployed without enabling disk encryption/encryption at host from the compliance or governance standpoint.

Azure Policy built-in definitions for Azure Virtual Machines:
OS and data disks should be encrypted with a customer-managed key
Virtual machines and virtual machine scale sets should have encryption at host enabled
Virtual machines should encrypt temp disks, caches, and data flows between Compute and Storage resources

I hope this helps!

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

Answer 4

Hello @JamesTran-MSFT If I do Encryption at host for my VM's, what kind of key points I've to take care to of? like does the VM changes the login credentials or whoever wants to access the machine have to take the key vault keys or disk encryption keys from me.?

Also please clarify what kind of steps I've to take care of implementation and also mention the cost for ADE and Encryption-at-host as well.

Thanks,

Jagadeesh