vm-encryption-at-host

Encryption at host (Azure VM)

What it is

Encryption at host is a per-VM encryption setting (EncryptionAtHost property = true) that encrypts every storage surface of the VM as it sits on the host node, at rest:

• the OS disk
• data (managed) disks
• the VM temp/scratch disk (the ephemeral/local disk D:)
• the cache that the host holds for the VM’s disks (the SSE cache on the host node, and single-temp-cache writes)

Why it exists

By default, server-side encryption (SSE) covers OS/data disks, but the temp/scratch disk and the host-side cache are not part of that default coverage. Encryption at host closes that gap, so no data written by the VM — including paging/temporary files on D: and cached I/O — sits on the host in cleartext, which strict compliance and security requirements demand.

Key ideas

• How to turn it on: set the VM’s encryptionAtHost: true property (enable it when creating the VM, or on an existing VM — frequently via CLI --encryption-at-host true or the portal “Encryption at host -> Enabled”). It is a VM-level setting, applied at the compute node.
• Key management: disks + cache are then encrypted with platform-managed keys by default, or you can use customer-managed keys stored in a Key Vault / disk-set for your own key rotation control.
• Supported hardware (SKUs): Encryption at host requires a VM size that supports it. It is supported on most general-purpose (D/Ds, B) and memory/optimized families, but not on every SKU — you must pick a VM size that advertises encryption-at-host support. Conversely, certain VM SKUs require encryption at host (they’re only offered with encryptionAtHost enabled), so you can’t opt out on those.
• Relationship to other encryption: Encryption at host is server-side encryption (SSE) of everything on that host, complementing (and working alongside) Azure Disk Encryption (ADE — guest-OS BitLocker/dm-crypt). ADE encrypts inside the guest; encryption at host encrypts everything at rest on the host node, including where ADE/SSE-by-default don’t reach (temp disk, cache).

Exam notes

• EncryptionAtHost property covers OS disk + data disks + TEMP disk + cache — TEMP is the thing to remember (ADE/SSE-default miss it).
• Requires a VM size that supports encryption at host; some SKUs require it.
• Defaults to platform-managed keys; can be changed to customer-managed keys.
• It’s a VM/compute-level SSE feature, distinct from ADE (guest-level encryption).

Related

azure-vm · managed-disks · vm-encryption-at-host · key-vault · storage-account

📘 Source: Microsoft Learn — Encryption at host (section in server-side disk encryption)