Skip to main content
emnode
Sign up
Compliance High severity MCSB DP-4

Microsoft Defender for Cloud · Virtual Machines

Linux virtual machines should enable Azure Disk Encryption or EncryptionAtHost

Written and reviewed by Emnode · Last reviewed

What does the recommendation "Linux virtual machines should enable Azure Disk Encryption or EncryptionAtHost" check?

Flags Linux VMs where neither Azure Disk Encryption (ADE) nor EncryptionAtHost is turned on. This is a Guest Configuration check, so it only evaluates a VM once the machine has a system-assigned managed identity and the Guest Configuration extension installed; without those prerequisites the VM reports as not applicable rather than compliant. It does not check the platform-managed encryption that already protects OS and data disks at rest by default, because the gap it cares about is the temp (resource) disk, the disk caches and the in-flight data between the compute host and storage, which default encryption leaves in clear. Either ADE or EncryptionAtHost closes that gap, so enabling just one of the two satisfies the control.

Why does "Linux virtual machines should enable Azure Disk Encryption or EncryptionAtHost" matter?

The temp disk, host cache and the compute-to-storage data path are exactly where a noisy workload spills secrets: swap pages, scratch files, decrypted credentials and cached blocks all land somewhere the default platform key never reaches. An attacker with host-level or out-of-band access to the underlying infrastructure, or anyone who recovers a temp disk that was not wiped, can read that data without ever touching your key vault. For a regulated workload that single uncovered surface can fail an audit or turn a contained host compromise into a reportable data breach. EncryptionAtHost extends encryption to all of those surfaces with platform-managed keys and no in-guest agent, removing the blind spot that default disk encryption alone leaves open.

How do I fix "Linux virtual machines should enable Azure Disk Encryption or EncryptionAtHost"?

  1. Register the feature once per subscription: run 'az feature register --name EncryptionAtHost --namespace Microsoft.Compute', wait for it to show Registered, then run 'az provider register --namespace Microsoft.Compute' to propagate it.
  2. Enable it on the VM: deallocate the machine, then run 'az vm update -n <vm> -g <rg> --set securityProfile.encryptionAtHost=true' and start it again (the VM must be stopped/deallocated for the host setting to apply). For VMs you cannot move to a host-encryption-capable size, use Azure Disk Encryption instead, which satisfies the same control.
  3. Make it the default and enforce it: set 'securityProfile: { encryptionAtHost: true }' in your Bicep or Terraform VM module, and assign the built-in audit policy by display name so drift is caught: pid=$(az policy definition list --query "[?displayName=='Linux virtual machines should enable Azure Disk Encryption or EncryptionAtHost.'].name" -o tsv); az policy assignment create --name linux-vm-host-encryption --policy "$pid" --scope <scope>.

Remediation script · bash

# 1. Free, universal fix: enable Transparent Data Encryption on a SQL database.
az sql db tde set \
  --resource-group rg-data \
  --server sql-fintech-prod \
  --database payments \
  --status Enabled

# 2. Free, universal fix: encrypt VM temp disks, caches and data flows.
az feature register --namespace Microsoft.Compute --name EncryptionAtHost
az vm deallocate --resource-group rg-app --name vm-tooling-01
az vm update --resource-group rg-app --name vm-tooling-01 \
  --set securityProfile.encryptionAtHost=true
az vm start --resource-group rg-app --name vm-tooling-01

# 3. Only where required: customer-managed key on a storage account.
az storage account update \
  --name stbankingprod \
  --resource-group rg-data \
  --encryption-key-source Microsoft.Keyvault \
  --encryption-key-vault "https://kv-banking-cmk.vault.azure.net" \
  --encryption-key-name sa-cmk

echo "TDE on, host encryption on, CMK applied to the one regulated store."

Full walkthrough (console steps, edge cases and verification) in the lesson Encrypt Azure data at rest, including customer-managed keys.

Is "Linux virtual machines should enable Azure Disk Encryption or EncryptionAtHost" a false positive?

A Linux VM that already runs Azure Disk Encryption can still surface here if its system-assigned identity or Guest Configuration extension is missing, because the policy cannot read the in-guest state to confirm ADE is active. Add the managed identity and the extension and the finding clears. A genuine accepted exception is a short-lived, stateless VM size that does not support EncryptionAtHost and holds no sensitive data on its temp disk: document the size constraint and exempt that resource rather than forcing it onto an unsupported SKU.

Full lesson Encrypt Azure data at rest, including customer-managed keys Step-by-step remediation with CLI, code and persona-specific context.
Defender for Cloud recommendations ↗ Check your own account →
Part of the learning path Encrypt across Azure

More Virtual Machines controls