Windows virtual machines should enable Azure Disk Encryption or EncryptionAtHost

What does the recommendation "Windows virtual machines should enable Azure Disk Encryption or EncryptionAtHost" check?

Flags any Windows VM that has neither Azure Disk Encryption (ADE) nor encryption at host enabled. Managed OS and data disks are already encrypted at rest by default with platform-managed keys, so this control does not check that. What it targets is the gap that default encryption leaves open: the temporary disk, the OS and data disk caches, and the data flowing between the compute host and the storage cluster, none of which platform-managed key encryption covers. ADE addresses this in the guest using BitLocker, while encryption at host addresses it below the guest at the hypervisor. The control is satisfied by either, and does not inspect the key type, so a VM using only the default platform key on its managed disks still flags until you turn on one of the two.

Why does "Windows virtual machines should enable Azure Disk Encryption or EncryptionAtHost" matter?

The unencrypted temp disk and disk caches are where pagefiles, swapped memory and short-lived secrets land, and the compute-to-storage path is where that data moves in clear. An attacker who recovers a host's local SSD, or who intercepts the storage flow, can read material that your at-rest disk encryption was never protecting. For a regulated workload this is the difference between a clean audit and a finding: standards that mandate encryption of data in transit and at rest treat the temp disk and cache gap as in scope. Closing it removes a class of evidence that data could have been exposed, which matters both to the breach itself and to what you have to disclose afterwards.

How do I fix "Windows virtual machines should enable Azure Disk Encryption or EncryptionAtHost"?

1. Register the host-encryption feature once per subscription with 'az feature register --namespace Microsoft.Compute --name EncryptionAtHost', wait until 'az feature show' reports Registered, then re-register the provider with 'az provider register --namespace Microsoft.Compute'.
2. Deallocate the VM, then enable host encryption with 'az vm update -n <vm> -g <rg> --set securityProfile.encryptionAtHost=true' and start it again; in Bicep set 'securityProfile.encryptionAtHost: true' on the Microsoft.Compute/virtualMachines resource. Choose Azure Disk Encryption instead if you specifically need BitLocker inside the guest, but never both, as they are mutually exclusive.
3. Assign the built-in audit policy so new VMs are caught going forward. Look the definition up by name rather than pasting a GUID: pid=$(az policy definition list --query "[?displayName=='Windows virtual machines should enable Azure Disk Encryption or EncryptionAtHost.'].name" -o tsv); az policy assignment create --name win-vm-disk-enc --policy "$pid" --scope <scope>.

# 1. Free, universal fix: enable Transparent Data Encryption on a SQL database.
az sql db tde set \
  --resource-group rg-data \
  --server sql-fintech-prod \
  --database payments \
  --status Enabled

# 2. Free, universal fix: encrypt VM temp disks, caches and data flows.
az feature register --namespace Microsoft.Compute --name EncryptionAtHost
az vm deallocate --resource-group rg-app --name vm-tooling-01
az vm update --resource-group rg-app --name vm-tooling-01 \
  --set securityProfile.encryptionAtHost=true
az vm start --resource-group rg-app --name vm-tooling-01

# 3. Only where required: customer-managed key on a storage account.
az storage account update \
  --name stbankingprod \
  --resource-group rg-data \
  --encryption-key-source Microsoft.Keyvault \
  --encryption-key-vault "https://kv-banking-cmk.vault.azure.net" \
  --encryption-key-name sa-cmk

echo "TDE on, host encryption on, CMK applied to the one regulated store."