What does "SSE with PMK & ADE" mean?

Anuj Jain 71 Reputation points

I understand what Server Side Encryption and Azure Disk Encryption mean and how you can turn them on.
I don't understand that when I turn on the ADE (BitLocker) for a (windows) VM's OS disk, the OS disk encryption says "SSE with PMK & ADE." Isn't that super confusing? How can ADE be used along with SSE? I understand SSE cannot be turned off, but I thought it was true only for data disks.

My confusion is this:
If I use BitLocker on a laptop, it provides OS-level encryption, which is all one needs. So in the case of Azure OS disk encryption, is it using double encryption with SSE and ADE?


Azure Disk Encryption
Azure Disk Encryption
An Azure service for virtual machines (VMs) that helps address organizational security and compliance requirements by encrypting the VM boot and data disks with keys and policies that are controlled in Azure Key Vault.
162 questions
0 comments No comments
{count} vote

Accepted answer
  1. SaiKishor-MSFT 17,206 Reputation points

    @Anuj Jain Server side encryption [SSE] is default offering. All of your Azure VMs managed disks are always encrypted by default when they are stored on underlying storage. This is encryption at rest by the Azure itself.

    You don’t need any additional efforts to perform Server Side Encryption of Azure VM Managed disk. More importantly you can't disable it as well. Server side encryption is not optional, and always provided behind the scene.

    Azure Disk Encryption of Azure VM Managed Disks
    Azure Disk Encryption [ADE] is optional. This method provides an extra layer of security over SSE. This encryption is performed at OS level of VM and hence there are many conditions where ADE is supported/ not supported. Where as SSE is always performed at backend storage level and has nothing to do with OS of VM being encrypted.

    Does this answer your question? Please let us know if you have any more questions and we will be glad to assist you further. Thank you!


    Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

    Want a reminder to come back and check responses? Here is how to subscribe to a notification.

    2 people found this answer helpful.

0 additional answers

Sort by: Most helpful