Azure Local CSV

Question

Azure Local CSV

Handian Sudianto 7,116

When we build azure local there are process to encrypt yhe CSV volumes. Are this mean if somebody copy the VHD to the outside example to personal device, then the VHD can be opened or still protected?

User's image

0 comments

2 answers

Your answer

Answer 1

Hi Handian,

Thank you for your question. This is a good point to clarify regarding Azure Local security.

Azure Local uses BitLocker Drive Encryption to encrypt data volumes, including Cluster Shared Volumes (CSV), which ensures that data is protected at rest. However, this encryption applies to the underlying host storage and does not automatically encrypt the contents inside individual VHD or VHDX files. This means that if a VHD or VHDX file is copied outside the cluster, for example to a personal device, it can be mounted and accessed if the data inside the virtual disk is not separately encrypted (for example, using BitLocker within the virtual machine).

From a security standpoint, protection depends on maintaining the encrypted state of the volume as well as ensuring that the data inside the virtual disks is appropriately protected. Microsoft recommends storing recovery keys in a secure external location such as Azure Key Vault. If guest-level encryption is enabled and the keys are securely managed, the copied VHD will remain protected even outside the cluster. However, if the data inside the VHD is not encrypted or the recovery key is compromised, then the data could potentially be accessed.

Reference: Manage BitLocker encryption on Azure Local

Use BitLocker with Cluster Shared Volumes (CSV)

Security features for Azure Local

https://learn.microsoft.com/en-us/azure/key-vault/general/overview

Hope this helps! If it helpful! Could you please accept the answer and upvote it. Please let me know if you have any queries in comments.

Handian Sudianto 7,116 Reputation points

2026-04-24T00:32:49.6433333+00:00

Hello,

I try create test VM under Azure Local, install the OS and poweroff the VM. Then i copy the vhd file to my workstation and the vdh can be mounted and i can see the files. How we can prevent this?
Jilakara Hemalatha 13,340 Reputation points Microsoft External Staff Moderator

2026-04-24T05:44:39.4466667+00:00

The encryption in Azure Local (using BitLocker on CSV) protects data on the host disks, but it does not encrypt the VHD file itself. So when you copy the VHD out, it can be mounted and read if the VM disk inside is not encrypted.

To prevent this, you need to enable BitLocker inside the VM (guest OS level). This ensures that even if the VHD is copied elsewhere, the data remains protected and cannot be accessed without the key.

Answer 2

Encrypting Cluster Shared Volumes (CSVs) with BitLocker on Azure Local protects the underlying disks, including the VHD/VHDX files stored on them.

If someone copies a VHD/VHDX file off an encrypted CSV to a personal device, the protection depends on how it is copied:

If the VHD is copied while the CSV is online and unlocked (normal cluster operation), the copied VHD file itself is no longer on a BitLocker‑protected volume. It can be attached and opened on another system like any normal VHD, subject only to whatever protection exists inside the guest OS (for example, if the VM uses its own BitLocker/TDE, that inner encryption still applies).
BitLocker protection applies to the CSV volume, not to individual VHD files as portable encrypted containers. Once data is read from the encrypted volume and written elsewhere, the new copy is not protected by that CSV’s BitLocker.

To keep VM data protected when VHDs are copied off the cluster, an additional encryption layer is required inside the VM (for example, BitLocker in the guest OS or database‑level encryption), or the destination storage must also be encrypted.

References:

Share via

Azure Local CSV

2 answers

Your answer