Share via

ADE is only enabled on OS disk but not on temporary storage

Tan-9136 100 Reputation points
2025-05-20T22:12:51.0266667+00:00

Hi,

I was checking my Secure Score and I found this recommendation message:
"Windows virtual machines should enable Azure Disk Encryption or EncryptionAtHost"

Some of my VMs are considered to have ADE but some are considered to not have ADE even though ADE is shown as enabled on the VM overview page.

What I noticed the difference between the ones that are recognized to have ADE and the ones that are NOT recognized to have ADE is the temporary storage (it's in the D drive).
For some reasons, some VMs have ADE in their temporary storage and some don't.
And I don't know why.

How do I enable ADE in temporary storage?
And if I do enable it, will it cause any issue? Because this is a production environment.

Thanks

Azure Disk Encryption
Azure Disk Encryption
An Azure service for virtual machines (VMs) that helps address organizational security and compliance requirements by encrypting the VM boot and data disks with keys and policies that are controlled in Azure Key Vault.
182 questions
Accepted answer
  1. Alex Burlachenko 8,765 Reputation points
    2025-05-23T08:21:30.0066667+00:00

    Hi there Tan-9136

    thank you for your follow-up question! Let me break this down in a simple way so it’s easy to follow.

    Yes, you can absolutely enable Azure Disk Encryption (ADE) through the Azure Portal without needing to use the command line! When you’re in the "Disk settings" page of your Windows VM, you’ll see the option for Azure Disk Encryption under the Encryption settings section. If you select OS and data disks, that’s indeed the same as setting the VolumeType to "All" in the command line. This means both the OS disk and any attached data disks will be encrypted.

    Now, about your concern for the production environment that’s a very valid question! Enabling ADE shouldn’t cause any major issues, but there are a few things to keep in mind. First, the encryption process itself might take some time, depending on the size of your disks, and the VM will reboot during the process. Also, make sure you have a proper Key Vault set up for the encryption keys, as this is required for ADE to work. Microsoft has a great guide on best practices for production workloads here: Azure Disk Encryption prerequisites.

    One thing to note if your VM has any critical workloads running, it might be a good idea to test this in a staging environment first, just to be safe. And of course, always ensure you have recent backups before making any changes!

    Hope this helps.

    Best regards, Alex
P.S. If my answer help to you, please Accept my answer
PPS That is my Answer and not a Comment
https://ctrlaltdel.blog/
    1 person found this answer helpful.
    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Silvia Wibowo 5,966 Reputation points Microsoft Employee Volunteer Moderator
    2025-05-25T22:19:55.3166667+00:00

    Hi @Tan-9136 , let me summarize your issue and provide you with explanation that can answer your question.

    Current situation:

    • Azure Advisor's Secure Score recommends "Windows virtual machines should enable Azure Disk Encryption or EncryptionAtHost". It lists some of the VMs. You noticed that the VMs in that list has temporary (local) storage, with SKU: Standard D4s v3.
    • On the affected VMs:
      • Overview page of the VM and the disk page show encryption enabled.
      • Under "Disk settings", ADE (Azure Disk Encryption) shows None (OS and Data disks are not enabled for ADE).

    Question: how to execute Secure Score's recommendation to enable ADE?

    Explanation:

    There are several types of encryption available for your managed disks, including Azure Disk Encryption (ADE), Server-Side Encryption (SSE), and encryption at host. Ref: Managed disk encryption options.

    SSE is always enabled; this is what your VM "Overview" page and your disk page refer by "encryption enabled".

    ADE needs to be enabled, you can use Azure CLI, PowerShell, or Azure Portal to enable it, choosing OS, Data, or All (OS and Data) disks. You should take a snapshot and/or create a backup before disks are encrypted. Backups ensure that a recovery option is possible if an unexpected failure occurs during encryption. VMs with managed disks require a backup before encryption occurs.

    Enabling ADE will:

    Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

    1 person found this answer helpful.
    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.