Write a query to see what disks are encrypted with ADE verses just the standard SSE with PMK

Question

Hi there - I'm trying to figure out how to search all the disks that have encryption set with ADE and any other type of encryption that is support like CMK.

Thanks

Answer 1

Hello @Parm Dhesi ,

After looking at the additional settings for those disks (i.e. disk with SSE with PMK & ADE vs SSE with PMK) , the only different which I observed was :

for PMK with ADE - in the properties of the disk you will see diskEncryptionKey attribute

for PMK with SSE - in the properties of the disk there won't be key

Having said that , I was thinking of below modified queries to find out those types of disks

resources | where type == "microsoft.compute/disks"

| extend properties=parse_json(properties)

| where properties.encryption["type"] == "EncryptionAtRestWithPlatformKey"

| where properties.encryptionSettingsCollection["enabled"] == "true"

| project name, properties

Kindly let me know if you have additional questions !

regards,

Shiva.

Answer 2

Hello @Parm Dhesi ,

Can you try out the below steps , see if those helps !

I just tried out locally and below are the results with screen shots. Let me know if that helps or if you have any additional questions !

Go to "Azure Resource Graph Explorer" on the Azure Portal

Below query will give you all the disk details:

resources | where type == "microsoft.compute/disks"

| extend properties=parse_json(properties)

| project name, properties.encryption

////////////////////////

Below query will filter out the search based up on the criteria

resources | where type == "microsoft.compute/disks"

| extend properties=parse_json(properties)

| where properties.encryption["type"] == "EncryptionAtRestWithCustomerKey"

| project name, properties.encryption

Regards,

Shiva.

Answer 3

@shiva patpi Thanks for your assistance I was only able to have results with "EncryptionAtRestWithPlatformKey" but I know I have another type of encryption enabled. Please see my attached picture. How can I query "SSE with PMK & ADE" diskes for all the VM's.