How to change from VM with ADE to VM to Encryption at host?

Question

Hi everyone,

I would like to know the proper steps to change from VM with ADE to Encryption at host.

Thank you

Answer 1

Hi Anashetty,

Your suggestion wasn't the solution but it did stir me to the right direction, thank you!
I found out the issue that caused "Disk security type is not compatible with VM security type" message.
In order for the OS disk swap to work, I will need to make sure the new VM instance has the same "Security Type" as the old VM that I removed ADE from.
Original VM is in Standard Security Type so I had to make the new VM instance to be in Standard Security Type (it was defaulted "TrustedLaunch").

Mystery solved!

Answer 2

Hi Handinata Tanudjaja,

As the original poster cannot accept their own answer, I am reposting it if you would like to Upvote and Accept answer for the benefit of community who faces the same issue can easily find the solution.

Issue:

we have an existing VM with ADE enabled. We don't want to change the existing VM but we want to be able to use a backup of the disk to a new VM with Encrypted At Host (EAH) enabled.

I received the following error when I tried to swap the OS disk: "**Disk security type is not compatible with VM security type" ** I am not sure why I would get this error. I thought that by disabling the ADE of the new backup this, I would be able to use it a VM instance that has EAH enabled.

Solution:

I found out the issue that caused "Disk security type is not compatible with VM security type" message. In order for the OS disk swap to work, I will need to make sure the new VM instance has the same "Security Type" as the old VM that I removed ADE from. Original VM is in Standard Security Type, so I had to make the new VM instance to be in Standard Security Type (it was defaulted "TrustedLaunch").

Mystery solved!

Thank you again for your time and patience throughout this issue. Please remember to "Upvote" and "Accept Answer", so that others in the community facing similar issues can easily find the solution.

Thank you.

Answer 3

Hello @HandinataTanudjaja-6677

To convert an Azure VM with Azure Disk Encryption (ADE) to using "Encryption at Host," you need to first detach the existing encrypted disks from the VM, then create a new VM with the "Encryption at Host" option enabled, and finally attach the previously detached encrypted disks to the new VM; essentially, you're creating a new VM with the desired encryption method and migrating the existing disks to it, as you cannot directly change an existing VM's encryption method from ADE to Encryption at Host. 

Key steps:

• Access Azure Portal:

Log in to the Azure portal and navigate to your virtual machine. 

• Detach Disks:
  • Go to the VM's "Disks" section. 
    • Select each disk you want to migrate and choose the option to "Detach". 
    • Create New VM with Encryption at Host:
      • Initiate the creation of a new virtual machine. 
        • When configuring the disks, select "Encryption at Host" under the encryption settings. 
          • Choose the appropriate key management option (customer-managed keys or platform-managed keys). 
          • Attach Detached Disks:
            • Once the new VM is deployed, navigate to its "Disks" section. 
              • Select "Attach existing disk" and choose the previously detached encrypted disks. 

Important Considerations:

• Data Migration: If you have sensitive data on the existing disks, ensure you have a proper backup strategy before detaching and migrating them. 
• VM Downtime: Converting to "Encryption at Host" will require a VM restart, resulting in temporary downtime. 
• Key Management: Be mindful of the key management strategy you choose when enabling "Encryption at Host". To convert an Azure VM with Azure Disk Encryption (ADE) to using "Encryption at Host," you need to first detach the existing encrypted disks from the VM, then create a new VM with the "Encryption at Host" option enabled, and finally attach the previously detached encrypted disks to the new VM; essentially, you're creating a new VM with the desired encryption method and migrating the existing disks to it, as you cannot directly change an existing VM's encryption method from ADE to Encryption at Host.  Key steps:
  • Access Azure Portal: Log in to the Azure portal and navigate to your virtual machine. 
  • Detach Disks:
    • Go to the VM's "Disks" section. 
    • Select each disk you want to migrate and choose the option to "Detach". 
  • Create New VM with Encryption at Host:
    • Initiate the creation of a new virtual machine. 
    • When configuring the disks, select "Encryption at Host" under the encryption settings. 
    • Choose the appropriate key management option (customer-managed keys or platform-managed keys). 
  • Attach Detached Disks:
    • Once the new VM is deployed, navigate to its "Disks" section. 
    • Select "Attach existing disk" and choose the previously detached encrypted disks. 
  Important Considerations:
  • Data Migration: If you have sensitive data on the existing disks, ensure you have a proper backup strategy before detaching and migrating them. 
  • VM Downtime: Converting to "Encryption at Host" will require a VM restart, resulting in temporary downtime. 
  • Key Management: Be mindful of the key management strategy you choose when enabling "Encryption at Host". 

---

If the Answer is helpful, please click Accept Answer and Up-Vote, so that it can help others in the community looking for help on similar topics.