Azure Resource Graph Explorer - How to query Disk Encryption for OS Disks and Data Disks

Question

I am fairly new to querying Azure Resources using the Resource Graph Explorer. I have been able to use sample queries to looks up properties of my VMs, Storage, Subscriptions, etc. and display in unique order. It's pretty powerful stuff.

Unfortunately I'm having troubles querying the field called "Encryption" to display all the unique values that can reside in this attribute. I want to run a query for all my subscriptions/all VMs/all disks that may or may not have an encryption value for all disks.

I have search the Category "Disks" and I can't find it. I have even searched by Table and still no luck.

Any help is appreciated.

Thanks

Parm

Answer 1

Using the Azure Resource Graph Explorer (Using the Azure Resource Graph Explorer (https://azure.microsoft.com/en-us/get-started/azure-portal/resource-graph/#overview), I created the following KQL query:), I created the following KQL query:

Resources
| where type == "microsoft.compute/disks"
| project diskName=name, diskSizeGB=properties.diskSizeGB, diskSKU=sku.name, encryptionType=properties.encryption.type, diskState=properties.diskState

The encryption data for my environment only contained the following, as its Platform managed:

Answer 2

@Parm Dhesi - Welcome to Microsoft Q&A and thanks for reaching out to us.

Do you have VMs with encryption deployed with customer managed keys?

if you used platform host encryption that is the only value that you will see. In ARG the only value will be EncryptionAtRestWithPlatformKey which means SSE with PMK, if you use customer managed keys, I suspect the value should be different.

Hope this helps. and please feel free to reach out if you have any further questions.

---

If the above response was helpful, please feel free to "Accept as Answer" and "Upvote" the same so it can be beneficial to the community.