disk-encryption

name	disk-encryption
description	Choose between PMK, CMK, double encryption, and encryption at host

Disk Encryption

When to use this skill

• Any production VM
• Regulatory data (PII, PCI, HIPAA)

Key concepts

• PMK (Server-Side Encryption with Platform Key) — default, free, transparent.
• CMK (Customer-Managed Key) — your Key Vault key, lets you revoke; needs DES (Disk Encryption Set).
• Double Encryption at rest — PMK + CMK layered.
• Encryption at host — encrypts cache + temp disk; requires SKU support and subscription feature enable.
• Azure Disk Encryption (ADE, in-guest) — BitLocker/dm-crypt with Key Vault; older approach, prefer SSE+host.

Common pitfalls

• Mixing ADE and host encryption — unsupported.
• CMK without soft-delete/purge protection on the Key Vault — losing the key bricks the VM.

References

• Microsoft Learn: search for "Disk Encryption Azure VM" on https://learn.microsoft.com

---

Validation-first: verify every Azure fact against the Microsoft Learn MCP server (cite the Learn URL); Learn overrides built-in knowledge. If no Learn MCP server is configured, flag the answer ⚠️ unverified and mark specs as indicative. Analysis only — verify against Microsoft documentation before applying.