Disk Encryption in Azure VM

Question

I want to apply storage disk encryption on my Azure VM with minimum downtime or without stopping my VM.

Answer 1

Hi @Khushi Gupta

as per the documentation, enabling Azure disk encryption "may" reboot your VM. That's the case for both windows and linux VMs.

https://learn.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-linux#enable-encryption-on-an-existing-or-running-linux-vm

The process described in the documentation is the one you have to go for. In the documentation is also a hint on what is actually happening (Extension).

Cheers,
Sebastian

Answer 2

@Khushi Gupta Adding more information to the above response!

Encrypting or disabling encryption may cause a VM to reboot.( Then only necessary changes will take place)

For Azure Disk Encryption, we can break it down into two processes - extension installation and encryption.

Extension installation: This can be thought of as after you hit "enter" to run "Set-AzVMDiskEncryptionExtension".
The install process itself should take about 5-10 minutes. Almost simultaneously, once the extension is installed, BitLocker will start checking your OS to see if it's compatible for ADE (size, formatting, partitioning, etc.), If it's not you'll error, if it is we can move to the encryption process.

Encryption:
This process is where BitLocker will prepare your OS for disk encryption (system partition created), generate protectors, communicate with the Azure Key Vault to create secrets, and return an output. Once your VM is prepared for ADE you'll receive a "successful/true" type of response for encryption. However, if your VM failed at any point when preparing for encryption, you'll receive an error message.

Assuming all goes well, you'll receive that "successful/true" response once your VM is prepared for ADE but before encryption finishes on your disks. Encryption time depends on the size of your disk(s). As an example, if you're using a 30GB OS disk, it can take about 20minutes to encrypt. However, if you're using a 30GB OS disk along with two 1TB data disks, encryption can take longer than 20minutes.

Additional information: Azure Disk Encryption FAQ

Please let us know if you have any further queries. I’m happy to assist you further.

----------

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.