Encryption at host (Azure VM)
What it is
Encryption at host is an Azure VM setting that starts encryption on the Azure host where the VM runs. It encrypts at rest the VM’s temporary disk, ephemeral OS disk, and the host-side caches for its OS and data disks before data flows to Azure Storage.
Why it exists
Azure server-side encryption (SSE) encrypts managed OS and data disks at rest by default. Temporary disks are not managed disks, so SSE alone does not generally cover them. Encryption at host closes that host-storage gap when the workload or compliance requirement needs it.
Key ideas
- Where it acts: this is host-level, server-side protection. It does not encrypt traffic in transit or decide who can access a VM.
- Key options: managed disks normally use platform-managed keys. Supported customer-managed-key designs use a disk encryption set and a key in Azure Key Vault or managed HSM. Key availability becomes an operational dependency: disabling, deleting, or expiring the key can stop disk I/O and prevent affected VMs from booting.
- Compatibility: VM-size support varies by region and generation. Check the intended size. An existing VM normally must be deallocated and reallocated for host encryption to take effect.
- Do not combine blindly: a VM or VM scale set that currently has—or has ever had—Azure Disk Encryption (ADE) cannot enable encryption at host, and ADE cannot be enabled on a disk already using encryption at host.
- Modern temporary-disk detail: version 5-and-later Azure VMs automatically encrypt their temporary disks and ephemeral OS disks at rest. Confirm the exact VM and workload behavior instead of assuming every temporary disk has the same protection.
Northwind example
Northwind’s compliance requirement covers data that might appear in paging files or disk cache. Maya chooses a VM size that supports encryption at host, verifies the workload is not using ADE, schedules the required deallocation, and tests the application after the change. If Northwind uses customer-managed keys, it also tests key-access monitoring and recovery; encryption is only reliable when the key path is reliable.
Exam notes
- SSE encrypts managed OS and data disks at rest by default; encryption at host adds protection for temporary storage and host-side caches.
- ADE is guest-OS BitLocker or DM-Crypt encryption, not the same feature, and it is incompatible with encryption at host.
- Encryption at rest does not replace RBAC, network controls, backup, or key-lifecycle management.
Related
azure-vm · managed-disks · key-vault · storage-account
📘 Source: Microsoft Learn — Server-side encryption of Azure Disk Storage