Can we add "Disk Encryption Set" managed Identity to AD groups

Question

As part of implementing Managed Disks SSE-CMK, we are planning to associate/add "Disk Encryption Set "managed Identity to Azure security AD groups. Is it possible?

As per my knowledge I can do this with user managed Identity, but would like to know whether same possible through AD groups or not.

Answer 1

@Venkat

Thank you for your post and I apologize for the delayed response!

I understand that you're leveraging Server-side encryption with Customer-managed keys and would like to know if it's possible to add a Disk Encryption Set's managed Identity to an Azure AD Security Group. To hopefully help point you in the right direction or resolve your issue, I'll share my findings below.

---

Findings:
Based off what I found, it's possible to associate a Disk Encryption Set's managed identity to an Azure AD group - When a disk encryption set is created, a system-assigned managed identity is created in Azure Active Directory (AD) and associated with the disk encryption set. For more info.

To add the Managed Identity to an Azure AD Security Group:

1. Create an Azure AD Group
2. Add your Disk Encryption Set Managed Identity to the Azure AD Group
3. Assign the required permissions to your Azure AD group.

---

Additional Links:

• View the service principal of a managed identity in the Azure portal
• Create a basic group and add members
• Best practices for Azure RBAC
• Best practices for Azure AD roles

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

---

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.