Azure Disk Encryption only on OS Disk

Philipp Gerber 251

i have a short Question about Azure Disk Encryption.
I have activated it on aditional Settings and have configured the Option "OS and Data Disk".

When i now look at the Diks i can see that only the OS diks is encrypted. I have activated ADE on a lot of VMs and on 10 VMs i have this Problem.

I see no Error or no Reason why the Data Disk Encrypt not works.

Can someone explain this?

Thanks a lot.

Regars,
Phil

KarishmaTiwari-MSFT 18,747 Reputation points Microsoft Employee

2022-10-17T16:49:23.27+00:00

@Philipp Gerber

Thanks for posting your query on Microsoft Q&A.

When you say, you look at the disks and see that only the OS disk is encrypted, do you mean in the Azure Portal? It does not show up in the Portal because it would be done in the OS level and thus wouldn't show up at the platform level initially. Please check the BitLocker status within the VM and this should help confirm that the data disks are encrypted.

Sometime you may see that the disks are not encrypted in the Portal due to the following reasons:

1.Encryption inside guest OS should kick in automatically but in order to reflect in Azure Portal the encryption status for the new disk a Stop (de-allocate) must be performed in order for the extension to communicate the new status to the host.

2.This occurs when you disable encryption from OS level directly. The extension will not be updated by the OS if you manipulate manually Bitlocker as OS level. The manipulation of encryption must be done always using the high level commands for ADE extension.

There is a detailed explanation on the same issue in this post that you may find helpful : https://video2.skills-academy.com/en-us/answers/questions/631189/enabled-vm-disk-encryption-but-some-disks-are-not.html

Please go through this and let me know if you have any questions, I would be happy to investigate further.

Thanks.
Philipp Gerber 251 Reputation points

2022-10-20T06:30:35.64+00:00

Thanks a lot for your Answer.

Yes correct. I have change the Settings at the Azure Portal.

I have take a look directly at the VM and can see that the disk are unantatched. So i have atached the Disks and a fiew minutes later the Disk are encrypted.
Allright. But the Portal says the Diks are not with ADE encrypted.

So you mean i must do a Restart of the VM for the Communication between the Extension and the Azure Portal?

Share via

Azure Disk Encryption only on OS Disk