How to Enable Encryption in Azure Managed Disk?

Data security is of utmost importance in cloud environments. Azure Managed Disks offer the option to encrypt your data at rest using Azure Disk Encryption, which provides an additional layer of protection for your sensitive information. In this blog post, we will explore how to enable encryption in Azure Managed Disk using both the Azure Portal and Azure CLI.

Prerequisites

Before we proceed with enabling encryption for Azure Managed Disk, ensure you have the following prerequisites:

1. An active Microsoft Azure account with appropriate permissions to create resources.
2. An existing Azure Virtual Machine with Managed Disk(s) that you want to encrypt.

Step-by-Step Guide

Let’s dive into the process of enabling encryption in Azure Managed Disk using both Azure Portal and Azure CLI:

Step 1: Create an Azure Disk Encryption Set (AES) (Azure Portal)

1. Log in to the Azure Portal (https://portal.azure.com/) using your Azure account.
2. In the left-hand navigation pane, click on “Create a resource.”
3. Search for “Disk encryption set” and click on “Disk encryption set.”
4. Click on “Create” to start creating the Disk Encryption Set.
5. In the “Basics” tab, choose the subscription and resource group where you want to create the Disk Encryption Set.
6. Provide a unique name for the Disk Encryption Set.
7. Choose the region where the Disk Encryption Set should be located.
8. Optionally, you can configure “Platform Configuration” settings if needed.
9. Click “Next: Tags” to add any relevant tags or proceed to the next tab.
10. Review the configuration and click “Review + create.”
11. Finally, click “Create” to create the Azure Disk Encryption Set.

Step 1: Create an Azure Disk Encryption Set (AES) (Azure CLI)

1. Open a terminal or command prompt.
2. Use the following command to create the Disk Encryption Set:

Replace <encryption-set-name>, <resource-group-name>, and <region> with the appropriate values.

Step 2: Enable Encryption for the Managed Disk (Azure Portal)

1. In the Azure Portal, navigate to the virtual machine with the Managed Disk you want to encrypt.
2. Under “Settings,” click on “Disks.”
3. Click on the Managed Disk you want to encrypt.
4. In the top menu, click on “Disk encryption.”
5. In the “Disk encryption” blade, click on “Select disk encryption set.”
6. Choose the Disk Encryption Set you created in Step 1.
7. Click “Save” to enable encryption for the Managed Disk.

Step 2: Enable Encryption for the Managed Disk (Azure CLI)

1. Open a terminal or command prompt.
2. Use the following command to enable encryption for the Managed Disk:

Replace <resource-group-name>, <disk-name>, and <encryption-set-id> with the appropriate values.

Conclusion

Enabling encryption for Azure Managed Disks using Azure Disk Encryption Set provides a secure method to protect your data at rest. By following the step-by-step guide in this blog post, you can easily enable encryption for your Managed Disks using both the Azure Portal and Azure CLI. Take advantage of Azure Disk Encryption to enhance the security posture of your cloud infrastructure in Microsoft Azure.