Create CMK encryption for azure disk, with private endpoint for azure key vault

MS Techie 2,676 Reputation points
2023-03-23T10:22:02.4766667+00:00

For the azure disks, when we enabling CMK encryption , we create a azure disk encryption set and associate it the key generated from key vault and this is working fine. now the azure VM starts with CMK encryption and works fine.

Our requirement is traffic should flow over private endpoint.

My question is on the azure key vault, i will create a private endpoint. Now when i disable public internet access and disable access from allowing trusted microsoft services, then i see that azure disk encryption set is not able to reach azure key vault using its private endpoint.

User's image

How can we enable the azure disk encryption set to reach the azure keyvault using its private endpoint. ? Earlier before disabling access to the azure key vault and before creating private endpoint for key vault, i was able to start the azure VM successfully. i have already given the GET, WRAP and UNWRAP key permissions and it worked and i could start VM successfully, but not now... So my question is how to make azure disk encryption set reach azure key vault via its private endpoint.

Azure Virtual Machines
Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
7,127 questions
Azure Disk Encryption
Azure Disk Encryption
An Azure service for virtual machines (VMs) that helps address organizational security and compliance requirements by encrypting the VM boot and data disks with keys and policies that are controlled in Azure Key Vault.
160 questions

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Raviraj Nallasivam 165 Reputation points
    2023-03-24T00:57:46.7733333+00:00

    Did you tried enabling "Allowed Microsoft Trusted services" in networking section?

    User's image

    For more information, please refer to the https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-key-vault?tabs=azure-portal

    Please click Accepted Answer if it solves your problem or add a comment.

  2. Sumarigo-MSFT 43,641 Reputation points Microsoft Employee
    2023-03-26T03:01:09.91+00:00

    @MS Techie Welcome to Microsoft Q&A Forum, Thankyou for posting your query here!**
    **
    For disks attached to VMs there is no need for private endpoints.  

    From the error message, it looks like does not have the right permissions or roles assigned on the key vault. (wrap/unwrap permissions)

    Note: Traffic between VM and Disk will not need a private endpoint since they will be in the same v-net. We leverage private endpoints for unattached disks when it comes to exports with SAS URI's. I believe with regards to keyvault, we do a firewall bypass as a Microsoft trusted service.

    Please let us know if you have any further queries. I’m happy to assist you further.

    Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

  3. MS Techie 2,676 Reputation points
    2023-04-04T02:18:02.3533333+00:00

    I experimented myself and found that private endpoints for key vault does not support connectivity to azure disk encryption set. Our course, if azure VM was accessing some secret from key vault with private endpoint, it would have been possible, but here in my case the scenario is different, and azure disk encryption set set can only reach key vault only as trusted service access

    0 comments