What does "SSE with PMK & ADE" mean?

Question

I understand what Server Side Encryption and Azure Disk Encryption mean and how you can turn them on.
I don't understand that when I turn on the ADE (BitLocker) for a (windows) VM's OS disk, the OS disk encryption says "SSE with PMK & ADE." Isn't that super confusing? How can ADE be used along with SSE? I understand SSE cannot be turned off, but I thought it was true only for data disks.

My confusion is this:
If I use BitLocker on a laptop, it provides OS-level encryption, which is all one needs. So in the case of Azure OS disk encryption, is it using double encryption with SSE and ADE?

Thanks

Answer 1

@Anuj Jain Server side encryption [SSE] is default offering. All of your Azure VMs managed disks are always encrypted by default when they are stored on underlying storage. This is encryption at rest by the Azure itself.

You don’t need any additional efforts to perform Server Side Encryption of Azure VM Managed disk. More importantly you can't disable it as well. Server side encryption is not optional, and always provided behind the scene.

Azure Disk Encryption of Azure VM Managed Disks
Azure Disk Encryption [ADE] is optional. This method provides an extra layer of security over SSE. This encryption is performed at OS level of VM and hence there are many conditions where ADE is supported/ not supported. Where as SSE is always performed at backend storage level and has nothing to do with OS of VM being encrypted.

Does this answer your question? Please let us know if you have any more questions and we will be glad to assist you further. Thank you!

Remember:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Want a reminder to come back and check responses? Here is how to subscribe to a notification.