Azure Disk Encryption scenarios on Linux VMs

Important

Azure Disk Encryption is scheduled for retirement on September 15, 2028. Until that date, you can continue to use Azure Disk Encryption without disruption. On September 15, 2028, ADE-enabled workloads will continue to run, but encrypted disks will fail to unlock after VM reboots, resulting in service disruption.

Use encryption at host for new VMs, or consider Confidential VM sizes with OS disk encryption for confidential computing workloads. All ADE-enabled VMs (including backups) must migrate to encryption at host before the retirement date to avoid service disruption. See Migrate from Azure Disk Encryption to encryption at host for details.

Applies to: ✔️ Linux VMs ✔️ Flexible scale sets

Azure Disk Encryption for Linux virtual machines (VMs) uses the DM-Crypt feature of Linux to provide full disk encryption of the OS disk and data disks. Additionally, it encrypts the temporary disk when using the EncryptFormatAll feature.

Azure Disk Encryption is integrated with Azure Key Vault to help you control and manage the disk encryption keys and secrets. For an overview of the service, see Azure Disk Encryption for Linux VMs.

Prerequisites

You can apply disk encryption only to virtual machines of supported VM sizes and operating systems. You must also meet the following prerequisites:

• Requirements for VMs
• Networking requirements
• Encryption key storage requirements

In all cases, take a snapshot, create a backup, or both before disks are encrypted. Backups ensure that a recovery option is possible if an unexpected failure occurs during encryption. VMs with managed disks require a backup before encryption occurs. Once a backup is made, you can use the Set-AzVMDiskEncryptionExtension cmdlet to encrypt managed disks by specifying the -skipVmBackup parameter. For more information about how to back up and restore encrypted VMs, see the Azure Backup article.

Restrictions

If you previously used Azure Disk Encryption with Microsoft Entra ID to encrypt a virtual machine, you must continue to use this option to encrypt your virtual machine. See Azure Disk Encryption with Microsoft Entra ID (previous release) for details.

When encrypting Linux OS volumes, the VM is unavailable. Avoid SSH sign-ins while the encryption is in progress to prevent problems that block any open files that need to be accessed during the encryption process. To check progress, use the Get-AzVMDiskEncryptionStatus PowerShell cmdlet or the vm encryption show CLI command. You can expect this process to take a few hours for a 30-GB OS volume, plus extra time for encrypting data volumes. Data volume encryption time is proportional to the size and quantity of the data volumes unless the encrypt format all option is used.

Disabling encryption on Linux VMs is only supported for data volumes. Disabling encryption isn't supported on data or OS volumes if the OS volume is encrypted.

Azure Disk Encryption doesn't work for the following Linux scenarios, features, and technology:

• Encrypting basic tier VM or VMs created through the classic VM creation method.
• Encrypting v6 series VMs with temporary disks (Ddsv6, Dldsv6, Edsv6, Dadsv6, Daldsv6, Eadsv6, Dpdsv6, Dpldsv6, Epdsv6, or Endsv6). For more information, see the individual pages for each of these VM sizes listed on Sizes for virtual machines in Azure
• Encrypting V7 series and newer VM sizes.
• Disabling encryption on an OS drive or data drive of a Linux VM when the OS drive is encrypted.
• Encrypting the OS drive for Linux Virtual Machine Scale Sets.
• Encrypting custom images on Linux VMs.
• Integration with an on-premises key management system.
• Azure Files (shared file system).
• Network File System (NFS).
• Dynamic volumes.
• Ephemeral OS disks.
• Encryption of shared/distributed file systems like (but not limited to): DFS, GFS, DRDB, and CephFS.
• Moving an encrypted VM to another subscription or region.
• Creating an image or snapshot of an encrypted VM and using it to deploy more VMs.
• Kernel Crash Dump (kdump).
• Oracle ACFS (ASM Cluster File System).
• NVMe disks such as those on High performance computing VM sizes or Storage optimized VM sizes.
• A VM with "nested mount points," which are multiple mount points in a single path (such as "/1stmountpoint/data/2ndmountpoint").
• A VM with a data drive mounted on top of an OS folder.
• A VM on which a root (OS disk) logical volume is extended using a data disk.
• Resizing of the OS disk.
• 'L' family storage optimized VM size series.
• M-series VMs with Write Accelerator disks.
• Applying ADE to a VM that has disks encrypted with Encryption at Host or server-side encryption with customer-managed keys (SSE + CMK). Applying SSE + CMK to a data disk or adding a data disk with SSE + CMK configured to a VM encrypted with ADE is an unsupported scenario as well.
• Migrating a VM that is encrypted with ADE, or was ever encrypted with ADE, to Encryption at Host or server-side encryption with customer-managed keys.
• Encrypting VMs in failover clusters.
• Encryption of Azure Ultra Disks.
• Encryption of Premium SSD v2 disks.
• Encryption of VMs in subscriptions that have the Secrets should have the specified maximum validity period policy enabled with the DENY effect.

Install tools and connect to Azure

You can enable and manage Azure Disk Encryption through the Azure CLI and Azure PowerShell. To do so, you must install the tools locally and connect to your Azure subscription.

Azure CLI

The Azure CLI 2.0 is a command-line tool for managing Azure resources. The CLI is designed to flexibly query data, support long-running operations as non-blocking processes, and make scripting easy. You can install it locally by following the steps in Install the Azure CLI.

To Sign in to your Azure account with the Azure CLI, use the az login command.

az login

If you want to select a tenant to sign in under, use:

az login --tenant <tenant>

If you have multiple subscriptions and want to specify a specific one, get your subscription list with az account list and specify with az account set.

az account list
az account set --subscription "<subscription name or ID>"

For more information, see Get started with Azure CLI 2.0.

Azure PowerShell

The Azure PowerShell az module provides a set of cmdlets that use the Azure Resource Manager model for managing your Azure resources. You can use it in your browser with Azure Cloud Shell, or you can install it on your local machine by using the instructions in Install the Azure PowerShell module.

If you already installed it locally, make sure you use the latest version of Azure PowerShell SDK version to configure Azure Disk Encryption. Download the latest version of Azure PowerShell release.

To Sign in to your Azure account with Azure PowerShell, use the Connect-AzAccount cmdlet.

Connect-AzAccount

If you have multiple subscriptions and want to specify one, use the Get-AzSubscription cmdlet to list them, followed by the Set-AzContext cmdlet:

Set-AzContext -Subscription <SubscriptionId>

Running the Get-AzContext cmdlet verifies that the correct subscription is selected.

To confirm the Azure Disk Encryption cmdlets are installed, use the Get-command cmdlet:

Get-command *diskencryption*

For more information, see Getting started with Azure PowerShell.

Enable encryption on an existing or running Linux VM

In this scenario, you can enable encryption by using the Resource Manager template, PowerShell cmdlets, or CLI commands. If you need schema information for the virtual machine extension, see the Azure Disk Encryption for Linux extension article.

Important

Take a snapshot or back up a managed disk-based VM instance outside of and before you enable Azure Disk Encryption. You can take a snapshot of the managed disk from the portal or use Azure Backup. Backups ensure that a recovery option is possible if an unexpected failure occurs during encryption. After you make a backup, use the Set-AzVMDiskEncryptionExtension cmdlet to encrypt managed disks by specifying the -skipVmBackup parameter. The Set-AzVMDiskEncryptionExtension command fails against managed disk-based VMs until you make a backup and specify this parameter.

Encrypting or disabling encryption might cause the VM to reboot.

To disable the encryption, see Disable encryption and remove the encryption extension.

Using Azure CLI

You can enable disk encryption on your encrypted VHD by installing and using the Azure CLI command-line tool. You can use it in your browser with Azure Cloud Shell, or you can install it on your local machine and use it in any PowerShell session. To enable encryption on existing or running Linux VMs in Azure, use the following CLI commands:

Use the az vm encryption enable command to enable encryption on a running virtual machine in Azure.

• Encrypt a running VM:

  az vm encryption enable --resource-group "MyVirtualMachineResourceGroup" --name "MySecureVM" --disk-encryption-keyvault "MySecureVault" --volume-type [All|OS|Data]
  

• Encrypt a running VM by using KEK:

  az vm encryption enable --resource-group "MyVirtualMachineResourceGroup" --name "MySecureVM" --disk-encryption-keyvault  "MySecureVault" --key-encryption-key "MyKEK_URI" --key-encryption-keyvault "MySecureVaultContainingTheKEK" --volume-type [All|OS|Data]
  

  Note

  The syntax for the value of disk-encryption-keyvault parameter is the full identifier string: /subscriptions/[subscription-id-guid]/resourceGroups/[resource-group-name]/providers/Microsoft.KeyVault/vaults/[keyvault-name]
  The syntax for the value of the key-encryption-key parameter is the full URI to the KEK as in: https://[keyvault-name].vault.azure.net/keys/[kekname]/[kek-unique-id]

• Verify the disks are encrypted: To check on the encryption status of a VM, use the az vm encryption show command.

  az vm encryption show --name "MySecureVM" --resource-group "MyVirtualMachineResourceGroup"
  

To disable the encryption, see Disable encryption and remove the encryption extension.

Using PowerShell

Use the Set-AzVMDiskEncryptionExtension cmdlet to enable encryption on a running virtual machine in Azure. Before encrypting the disks, take a snapshot and back up the VM by using Azure Backup. The PowerShell scripts to encrypt a running Linux VM already specify the -skipVmBackup parameter.

• Encrypt a running VM: The following script initializes your variables and runs the Set-AzVMDiskEncryptionExtension cmdlet. The resource group, VM, and key vault, were created as prerequisites. Replace MyVirtualMachineResourceGroup, MySecureVM, and MySecureVault with your values. Modify the -VolumeType parameter to specify which disks you're encrypting.

   $KVRGname = 'MyKeyVaultResourceGroup';
   $VMRGName = 'MyVirtualMachineResourceGroup';
   $vmName = 'MySecureVM';
   $KeyVaultName = 'MySecureVault';
   $KeyVault = Get-AzKeyVault -VaultName $KeyVaultName -ResourceGroupName $KVRGname;
   $diskEncryptionKeyVaultUrl = $KeyVault.VaultUri;
   $KeyVaultResourceId = $KeyVault.ResourceId;
   $sequenceVersion = [Guid]::NewGuid();
  
   Set-AzVMDiskEncryptionExtension -ResourceGroupName $VMRGName -VMName $vmName -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId -VolumeType '[All|OS|Data]' -SequenceVersion $sequenceVersion -skipVmBackup;
  

• Encrypt a running VM by using KEK: You might need to add the -VolumeType parameter if you're encrypting data disks and not the OS disk.

   $KVRGname = 'MyKeyVaultResourceGroup';
   $VMRGName = 'MyVirtualMachineResourceGroup';
   $vmName = 'MyExtraSecureVM';
   $KeyVaultName = 'MySecureVault';
   $keyEncryptionKeyName = 'MyKeyEncryptionKey';
   $KeyVault = Get-AzKeyVault -VaultName $KeyVaultName -ResourceGroupName $KVRGname;
   $diskEncryptionKeyVaultUrl = $KeyVault.VaultUri;
   $KeyVaultResourceId = $KeyVault.ResourceId;
   $keyEncryptionKeyUrl = (Get-AzKeyVaultKey -VaultName $KeyVaultName -Name $keyEncryptionKeyName).Key.kid;
   $sequenceVersion = [Guid]::NewGuid();
  
   Set-AzVMDiskEncryptionExtension -ResourceGroupName $VMRGName -VMName $vmName -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId -KeyEncryptionKeyUrl $keyEncryptionKeyUrl -KeyEncryptionKeyVaultId $KeyVaultResourceId -VolumeType '[All|OS|Data]' -SequenceVersion $sequenceVersion -skipVmBackup;
  

  Note

  The syntax for the value of disk-encryption-keyvault parameter is the full identifier string: /subscriptions/[subscription-id-guid]/resourceGroups/[resource-group-name]/providers/Microsoft.KeyVault/vaults/[keyvault-name]
  The syntax for the value of the key-encryption-key parameter is the full URI to the KEK as in: https://[keyvault-name].vault.azure.net/keys/[kekname]/[kek-unique-id]

• Verify the disks are encrypted: To check on the encryption status of a VM, use the Get-AzVmDiskEncryptionStatus cmdlet.

  Get-AzVmDiskEncryptionStatus -ResourceGroupName 'MyVirtualMachineResourceGroup' -VMName 'MySecureVM'
  

To disable the encryption, see Disable encryption and remove the encryption extension.

Using a Resource Manager template

You can enable disk encryption on an existing or running Linux VM in Azure by using the Resource Manager template.

1. Select Deploy to Azure on the Azure quickstart template.

2. Select the subscription, resource group, resource group location, parameters, legal terms, and agreement. Select Create to enable encryption on the existing or running VM.

The following table lists Resource Manager template parameters for existing or running VMs:

Parameter	Description
vmName	Name of the VM to run the encryption operation.
keyVaultName	Name of the key vault that the encryption key should be uploaded to. You can get it by using the cmdlet (Get-AzKeyVault -ResourceGroupName <MyKeyVaultResourceGroupName>). Vaultname or the Azure CLI command az keyvault list --resource-group "MyKeyVaultResourceGroupName".
keyVaultResourceGroup	Name of the resource group that contains the key vault.
keyEncryptionKeyURL	URL of the key encryption key that's used to encrypt the encryption key. This parameter is optional if you select nokek in the UseExistingKek drop-down list. If you select kek in the UseExistingKek drop-down list, you must enter the keyEncryptionKeyURL value.
volumeType	Type of volume that the encryption operation is performed on. Valid values are OS, Data, and All.
forceUpdateTag	Pass in a unique value like a GUID every time the operation needs to be force run.
location	Location for all resources.

For more information about configuring the Linux VM disk encryption template, see Azure Disk Encryption for Linux.

To disable the encryption, see Disable encryption and remove the encryption extension.

Use EncryptFormatAll feature for data disks on Linux VMs

The EncryptFormatAll parameter reduces the time for Linux data disks to be encrypted. Partitions meeting certain criteria are formatted, along with their current file systems, then remounted back to where they were before command execution. If you wish to exclude a data disk that meets the criteria, you can unmount it before running the command.

When you run this command, Azure Disk Encryption formats any drives that were previously mounted and starts the encryption layer on top of the now empty drive. When you select this option, Azure Disk Encryption also encrypts the temporary disk attached to the VM. If the temporary disk is reset, Azure Disk Encryption reformats and re-encrypts the VM's temporary disk at the next opportunity. After the resource disk is encrypted, the Microsoft Azure Linux Agent can't manage the resource disk and enable the swap file, but you can manually configure the swap file.

Warning

Don't use EncryptFormatAll when needed data exists on a VM's data volumes. You can exclude disks from encryption by unmounting them. Try the EncryptFormatAll parameter on a test VM first to understand the feature parameter and its implications before you try it on the production VM. The EncryptFormatAll option formats the data disk and all the data on it is lost. Before proceeding, verify that disks you want to exclude are properly unmounted.

If you're setting this parameter while updating encryption settings, it might lead to a reboot before the actual encryption. In this case, you should remove the disk you don't want formatted from the fstab file. Similarly, you should add the partition you want encrypt-formatted to the fstab file before initiating the encryption operation.

EncryptFormatAll criteria

The parameter goes through all partitions and encrypts them as long as they meet all of the criteria below:

• Is not a root/OS/boot partition
• Is not already encrypted
• Is not a BEK volume
• Is not a RAID volume
• Is not an LVM volume
• Is mounted

Encrypt the disks that compose the RAID or LVM volume rather than the RAID or LVM volume.

Use the EncryptFormatAll parameter with Azure CLI

Use the az vm encryption enable command to enable encryption on a running virtual machine in Azure.

• Encrypt a running VM by using EncryptFormatAll:

  az vm encryption enable --resource-group "MyVirtualMachineResourceGroup" --name "MySecureVM" --disk-encryption-keyvault "MySecureVault" --volume-type "data" --encrypt-format-all
  

Use the EncryptFormatAll parameter with a PowerShell cmdlet

Use the Set-AzVMDiskEncryptionExtension cmdlet with the EncryptFormatAll parameter.

Encrypt a running VM by using EncryptFormatAll: As an example, the following script initializes your variables and runs the Set-AzVMDiskEncryptionExtension cmdlet with the EncryptFormatAll parameter. The resource group, VM, and key vault are prerequisites. Replace MyVirtualMachineResourceGroup, MySecureVM, and MySecureVault with your values.

$KVRGname = 'MyKeyVaultResourceGroup';
$VMRGName = 'MyVirtualMachineResourceGroup';
$vmName = 'MySecureVM';
$KeyVaultName = 'MySecureVault';
$KeyVault = Get-AzKeyVault -VaultName $KeyVaultName -ResourceGroupName $KVRGname;
$diskEncryptionKeyVaultUrl = $KeyVault.VaultUri;
$KeyVaultResourceId = $KeyVault.ResourceId;

Set-AzVMDiskEncryptionExtension -ResourceGroupName $VMRGName -VMName $vmName -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId -VolumeType "data" -EncryptFormatAll

Use the EncryptFormatAll parameter with Logical Volume Manager (LVM)

We recommend an LVM-on-crypt setup. For detailed instructions about the LVM on crypt configuration, see Configure LVM and RAID on ADE encrypted devices.

New VMs created from customer-encrypted VHD and encryption keys

In this scenario, you can enable encryption by using PowerShell cmdlets or CLI commands.

Use the instructions in the Azure Disk Encryption sample scripts to prepare pre-encrypted images for Azure. After the image is created, you can use the steps in the next section to create an encrypted Azure VM.

• Prepare a pre-encrypted Linux VHD

Important

Take a snapshot or back up a managed disk-based VM instance outside of and before you enable Azure Disk Encryption. You can take a snapshot of the managed disk from the portal, or you can use Azure Backup. Backups ensure that a recovery option is possible if an unexpected failure occurs during encryption. After you make a backup, use the Set-AzVMDiskEncryptionExtension cmdlet to encrypt managed disks by specifying the -skipVmBackup parameter. The Set-AzVMDiskEncryptionExtension command fails against managed disk-based VMs until you make a backup and specify this parameter.

Encrypting or disabling encryption might cause the VM to reboot.

Use Azure PowerShell to encrypt VMs with pre-encrypted VHDs

You can enable disk encryption on your encrypted VHD by using the PowerShell cmdlet Set-AzVMOSDisk. This example gives you some common parameters.

$VirtualMachine = New-AzVMConfig -VMName "MySecureVM" -VMSize "Standard_A1"
$VirtualMachine = Set-AzVMOSDisk -VM $VirtualMachine -Name "SecureOSDisk" -VhdUri "os.vhd" Caching ReadWrite -Linux -CreateOption "Attach" -DiskEncryptionKeyUrl "https://mytestvault.vault.azure.net/secrets/Test1/514ceb769c984379a7e0230bddaaaaaa" -DiskEncryptionKeyVaultId "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myresourcegroup/providers/Microsoft.KeyVault/vaults/mytestvault"
New-AzVM -VM $VirtualMachine -ResourceGroupName "MyVirtualMachineResourceGroup"

Enable encryption on a newly added data disk

You can add a new data disk using az vm disk attach, or through the Azure portal. Before you can encrypt, you need to mount the newly attached data disk first. You must request encryption of the data drive because the drive isn't usable while encryption is in progress.

Using Azure CLI

If the VM was previously encrypted with "All", then the --volume-type parameter should remain "All". All includes both OS and data disks. If the VM was previously encrypted with a volume type of "OS", then change the --volume-type parameter to "All" so that both the OS and the new data disk are included. If the VM was encrypted with only the volume type of "Data", then it can remain "Data" as demonstrated in the following example. Adding and attaching a new data disk to a VM isn't sufficient preparation for encryption. You must also format and properly mount the newly attached disk within the VM before enabling encryption. On Linux, you must mount the disk in /etc/fstab with a persistent block device name.

In contrast to PowerShell syntax, the CLI doesn't require you to provide a unique sequence version when enabling encryption. The CLI automatically generates and uses its own unique sequence version value.

• Encrypt data volumes of a running VM:

  az vm encryption enable --resource-group "MyVirtualMachineResourceGroup" --name "MySecureVM" --disk-encryption-keyvault "MySecureVault" --volume-type "Data"
  

• Encrypt data volumes of a running VM by using KEK:

  az vm encryption enable --resource-group "MyVirtualMachineResourceGroup" --name "MySecureVM" --disk-encryption-keyvault  "MySecureVault" --key-encryption-key "MyKEK_URI" --key-encryption-keyvault "MySecureVaultContainingTheKEK" --volume-type "Data"
  

Using Azure PowerShell

When you use PowerShell to encrypt a new disk for Linux, specify a new sequence version. The sequence version must be unique. The following script generates a GUID for the sequence version. Before you encrypt disks, take a snapshot and back up the VM by using Azure Backup. The PowerShell scripts to encrypt a newly added data disk already specify the -skipVmBackup parameter.

• Encrypt data volumes of a running VM: The following script initializes your variables and runs the Set-AzVMDiskEncryptionExtension cmdlet. Create the resource group, VM, and key vault as prerequisites before running the script. Replace MyVirtualMachineResourceGroup, MySecureVM, and MySecureVault with your values. Acceptable values for the -VolumeType parameter are All, OS, and Data. If the VM was previously encrypted with a volume type of "OS" or "All", then the -VolumeType parameter should be changed to "All" so that both the OS and the new data disk are included.

  $KVRGname = 'MyKeyVaultResourceGroup';
  $VMRGName = 'MyVirtualMachineResourceGroup';
  $vmName = 'MySecureVM';
  $KeyVaultName = 'MySecureVault';
  $KeyVault = Get-AzKeyVault -VaultName $KeyVaultName -ResourceGroupName $KVRGname;
  $diskEncryptionKeyVaultUrl = $KeyVault.VaultUri;
  $KeyVaultResourceId = $KeyVault.ResourceId;
  $sequenceVersion = [Guid]::NewGuid();
  
  Set-AzVMDiskEncryptionExtension -ResourceGroupName $VMRGName -VMName $vmName -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId -VolumeType 'data' –SequenceVersion $sequenceVersion -skipVmBackup;
  

• Encrypt data volumes of a running VM by using KEK: Acceptable values for the -VolumeType parameter are All, OS, and Data. If the VM was previously encrypted with a volume type of OS or All, change the -VolumeType parameter to All so that both the OS and the new data disk are included.

   $KVRGname = 'MyKeyVaultResourceGroup';
   $VMRGName = 'MyVirtualMachineResourceGroup';
   $vmName = 'MyExtraSecureVM';
   $KeyVaultName = 'MySecureVault';
   $keyEncryptionKeyName = 'MyKeyEncryptionKey';
   $KeyVault = Get-AzKeyVault -VaultName $KeyVaultName -ResourceGroupName $KVRGname;
   $diskEncryptionKeyVaultUrl = $KeyVault.VaultUri;
   $KeyVaultResourceId = $KeyVault.ResourceId;
   $keyEncryptionKeyUrl = (Get-AzKeyVaultKey -VaultName $KeyVaultName -Name $keyEncryptionKeyName).Key.kid;
   $sequenceVersion = [Guid]::NewGuid();
  
   Set-AzVMDiskEncryptionExtension -ResourceGroupName $VMRGName -VMName $vmName -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId -KeyEncryptionKeyUrl $keyEncryptionKeyUrl -KeyEncryptionKeyVaultId $KeyVaultResourceId -VolumeType 'data' –SequenceVersion $sequenceVersion -skipVmBackup;
  

  Note

  The syntax for the value of disk-encryption-keyvault parameter is the full identifier string: /subscriptions/[subscription-id-guid]/resourceGroups/[KVresource-group-name]/providers/Microsoft.KeyVault/vaults/[keyvault-name]
  The syntax for the value of the key-encryption-key parameter is the full URI to the KEK as in: https://[keyvault-name].vault.azure.net/keys/[kekname]/[kek-unique-id]

Disable encryption and remove the encryption extension

You can disable Azure Disk Encryption, and you can remove the Azure Disk Encryption extension. Disabling and removing are two distinct operations.

To remove ADE, first disable encryption and then remove the extension. If you remove the encryption extension without disabling ADE, the disks remain encrypted. If you disable encryption after removing the extension, the extension is reinstalled (to perform the decrypt operation) and must be removed a second time.

Warning

You can't disable encryption if the OS disk is encrypted. (OS disks are encrypted when the original encryption operation specifies volumeType=ALL or volumeType=OS.)

Disabling encryption works only when data disks are encrypted but the OS disk isn't.

Disable encryption

You can disable encryption by using Azure PowerShell, the Azure CLI, or with a Resource Manager template. Disabling encryption doesn't remove the extension (see Remove the encryption extension).

• Disable disk encryption with Azure PowerShell: To disable the encryption, use the Disable-AzVMDiskEncryption cmdlet.

  Disable-AzVMDiskEncryption -ResourceGroupName "MyVirtualMachineResourceGroup" -VMName "MySecureVM" -VolumeType "data"
  

• Disable encryption with the Azure CLI: To disable encryption, use the az vm encryption disable command.

  az vm encryption disable --name "MySecureVM" --resource-group "MyVirtualMachineResourceGroup" --volume-type "data"
  

• Disable encryption with a Resource Manager template:

  1. Select Deploy to Azure from the Disable disk encryption on running Linux VM template.
  2. Select the subscription, resource group, location, VM, volume type, legal terms, and agreement.
  3. Select Purchase to disable disk encryption on a running Linux VM.

Warning

After decryption starts, don't interfere with the process.

To check the progress of decryption, use the Get-AzVMDiskEncryptionStatus PowerShell cmdlet or the az vm encryption show CLI command. After the decryption process is complete, you can remove the encryption extension.

Remove the encryption extension

If you want to decrypt your disks and remove the encryption extension, you must disable encryption before removing the extension; see disable encryption.

Use Azure PowerShell or the Azure CLI to remove the encryption extension.

• Remove the encryption extension with Azure PowerShell: Use the Remove-AzVMDiskEncryptionExtension cmdlet.

  Remove-AzVMDiskEncryptionExtension -ResourceGroupName "MyVirtualMachineResourceGroup" -VMName "MySecureVM"
  

• Remove the encryption extension with the Azure CLI: Use the az vm extension delete command.

  az vm extension delete -g "MyVirtualMachineResourceGroup" --vm-name "MySecureVM" -n "AzureDiskEncryptionForLinux"
  

Next steps

• Azure Disk Encryption overview
• Azure Disk Encryption sample scripts
• Azure Disk Encryption troubleshooting