7 thoughts on “Azure – Enable Disk Encryption for ARM IaaS VM’s

    1. Hi ckuever,

      When you run the “Add-AzureKeyVaultKey -VaultName “KeyVault” -Name VaultKEK -Destination “HSM”

      Make sure you take note of the “ID” at the bottom of the output, this is the KEK URL
      (Disk Encryption does not support port numbers so you’ll need to remove the :443 when coming to use this command in your ARM Template)

      Have you tried my new guide, this utilises Azure AD ARM (Preview) without the need to provision an ASM Azure AD App



  1. Hi Craig,

    yes, thank you. As far as i understand that guide will use “only” BEK. This was already working fine in my Environment. But customer wants to backup the encrypted VM via Azure Backup and therefore (from the documentation) KEK (key encryption key) is additionally needed?

    does the new guide work with Azure Backup?

    Add-AzureKeyVaultKey -VaultName “KeyVault” -Name VaultKEK -Destination “Software” (Software cause no Need for HSM here) was successful andi removed the 443. The key is shown in the key vault, that’s fine but no secret (set-azurekeyvaultsecret?)

    Therefore the error KeyVaultSecretDoesNotExist …



    1. Hey mate, sorry for the late reply
      I haven’t tested the new method with Azure Backup, but I am fairly certain it would work 🙂
      Why are you using the switch “Software” and not HSM?
      You’re deploying it using the Azure button through GitHub or through Visual Studio?


  2. Can I simply just say what a comfort to discover somebody who genuinely understands what they are talking about on the
    web. You definitely know how to bring a problem to light and make it important.

    More and more people must check this out and understand this side of
    the story. It’s surprising you aren’t more popular given that you definitely have the gift.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s