Using Azure Powershell to encrypt windows IaaS VM disk

Windows IaaS VM provides a variety of ways to encrypt disks. This article introduces how to use Microsoft Azure to encrypt IaaS VM disks. Create a snapshot or backup before encrypting the disk. Backup ensures that the restore option is available in the event of an unexpected failure during encryption. VM with managed disks needs to be backed up before encryption occurs. After a backup, you can use Set-AzVMDiskEncryptionExtension cmdlet to encrypt the managed disk by specifying the-skipVmBackup parameter. You should create a key vault before encrypting the VM hard drive.

Click on the left navigation bar, enter key in the search box, and then select Key Vault from the drop-down box.

Click to create

Enter the name of the key vault, select the subscription, resource group, and location, and then click create

Run the following script in powershell:

$KVRGname = 'name of the resource group where the key vault belongs'

$VMRGName = 'name of the resource group where the key vault belongs'

$vmName ='VM name of the disk to be encrypted'

$KeyVaultName = 'Keyvault name'

$KeyVault = Get-AzKeyVault-VaultName $KeyVaultName-ResourceGroupName $KVRGname

$diskEncryptionKeyVaultUrl = $KeyVault.VaultUri

$KeyVaultResourceId = $KeyVault.ResourceId

Set-AzVMDiskEncryptionExtension-ResourceGroupName $VMRGname-VMName $vmName-DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl-DiskEncryptionKeyVaultId $KeyVaultResourceId

Verify that the disk is encrypted using Get-AzVmDiskEncryptionStatus-ResourceGroupName 'virtual machine resource group name p'-VMName' name

Also view in the portal, virtual machine dashboard-settings-disk, view encryption properties

As you can see from the image above, encryption is enabled