Azure disk encryption

prasantc 796 Reputation points
2020-08-27T04:52:19.94+00:00

I have a VM with 4 disk encrypted with SSE with PMK & ADE. I added two additional disk to increase the storage pool when I follow instruction -

$KVRGname = 'MyKeyVaultResourceGroup';
$VMRGName = 'MyVirtualMachineResourceGroup';
$vmName = 'MySecureVM';
$KeyVaultName = 'MySecureVault';
$KeyVault = Get-AzKeyVault -VaultName $KeyVaultName -ResourceGroupName $KVRGname;
$diskEncryptionKeyVaultUrl = $KeyVault.VaultUri;
$KeyVaultResourceId = $KeyVault.ResourceId;

Set-AzVMDiskEncryptionExtension -ResourceGroupName $VMRGname -VMName $vmName -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId;

From https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-windows#enable-encryption-on-a-newly-added-data-disk. The virtual machine did not reboot on its own. I tried running from powershell ISE and native shell in Azure. I rebooted the machine and two disk still shows only SSE with PMK.

My KeyVault has two encryption not sure which one was used by consultant when it was initially set thus unable apply above changes from portal GUI interface

Azure Key Vault
Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
1,124 questions
Azure Disk Storage
Azure Disk Storage
A high-performance, durable block storage designed to be used with Azure Virtual Machines and Azure VMware Solution.
572 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. JamesTran-MSFT 36,376 Reputation points Microsoft Employee
    2020-08-28T00:29:54.213+00:00

    @prasantc
    From the script that you posted it looks like you're missing the 'Sequence version' variable, which is needed when trying to encrypt a newly added data disk. Additionally, can you please make sure that your data disks are initialized and formatted in NTFS prior to re-running the encryption script.

    If you're still having issues please let me know.
    Thank you for your time and patience throughout this issue.