Correct the encryption-at-host default - #128679
Correct the encryption-at-host default#128679Brian Santacruz (bsantacruzms) wants to merge 2 commits into
Conversation
|
Learn Build status updates of commit 0cbf72e: ✅ Validation status: passed
For more details, please refer to the build report. |
|
Brian Santacruz (@bsantacruzms) : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
|
Brian Santacruz (@bsantacruzms) : Thanks for your contribution! The author(s) and reviewer(s) have been notified to review your proposed change. |
|
Can you review the proposed changes? IMPORTANT: When the changes are ready for publication, adding a #label:"aq-pr-triaged" |
prmerger-automator
Bot
added
the
aq-pr-triaged
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Updates the Azure Security Fundamentals overview to correct guidance around the default behavior for encryption at host vs. managed disk encryption at rest.
Changes:
- Updates the “VM disk encryption” section to state that server-side encryption at rest is default for Azure managed disks, while encryption at host is optional.
- Refreshes article metadata date.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| ### VM disk encryption | ||
|
|
||
| By default, [encryption at host](/azure/virtual-machines/disk-encryption) helps you encrypt your IaaS virtual machine disks. It provides server-side encryption at the VM host level through AES 256 encryption, which is FIPS 140-2 compliant. This encryption occurs without consuming VM CPU resources and provides end-to-end encryption for temporary disks, OS/data disk caches, and data flows to Azure Storage. By default, it uses platform-managed keys with no extra configuration required. Optionally, you can configure the solution with customer-managed keys stored in Azure Key Vault or Azure Key Vault Managed HSM when you need to control and manage your own disk-encryption keys. The solution ensures that all data on the virtual machine disks is encrypted at rest in your Azure storage. For more information on key management options, see [Key management in Azure](key-management.md). | ||
| Azure managed disks use [server-side encryption](/azure/virtual-machines/disk-encryption) at rest by default. Encryption at host is an optional virtual machine setting that extends encryption to temporary disks, OS and data disk caches, and data flows between the compute host and Azure Storage. Review supported VM sizes and restrictions before enabling encryption at host. You can use platform-managed keys or configure customer-managed keys stored in Azure Key Vault or Azure Key Vault Managed HSM. For more information, see [Overview of managed disk encryption options](/azure/virtual-machines/disk-encryption-overview) and [Key management in Azure](key-management.md). |
There was a problem hiding this comment.
Addressed in 23beb33. The link text now points to the managed disk encryption overview, and the detailed article is separately labeled "Server-side encryption of Azure managed disks."
| ### VM disk encryption | ||
|
|
||
| By default, [encryption at host](/azure/virtual-machines/disk-encryption) helps you encrypt your IaaS virtual machine disks. It provides server-side encryption at the VM host level through AES 256 encryption, which is FIPS 140-2 compliant. This encryption occurs without consuming VM CPU resources and provides end-to-end encryption for temporary disks, OS/data disk caches, and data flows to Azure Storage. By default, it uses platform-managed keys with no extra configuration required. Optionally, you can configure the solution with customer-managed keys stored in Azure Key Vault or Azure Key Vault Managed HSM when you need to control and manage your own disk-encryption keys. The solution ensures that all data on the virtual machine disks is encrypted at rest in your Azure storage. For more information on key management options, see [Key management in Azure](key-management.md). | ||
| Azure managed disks use [server-side encryption](/azure/virtual-machines/disk-encryption) at rest by default. Encryption at host is an optional virtual machine setting that extends encryption to temporary disks, OS and data disk caches, and data flows between the compute host and Azure Storage. Review supported VM sizes and restrictions before enabling encryption at host. You can use platform-managed keys or configure customer-managed keys stored in Azure Key Vault or Azure Key Vault Managed HSM. For more information, see [Overview of managed disk encryption options](/azure/virtual-machines/disk-encryption-overview) and [Key management in Azure](key-management.md). |
There was a problem hiding this comment.
Addressed in 23beb33. "Supported VM sizes and restrictions" now links directly to the encryption-at-host restrictions section. I also verified that the destination and section anchor are live.
|
Learn Build status updates of commit 23beb33: ✅ Validation status: passed
For more details, please refer to the build report. |
Thank you, I will make sure I include "sign-off" next time, I have also updated the doc with the proposed changes. |
|
sign-off |
|
Brian Santacruz (@bsantacruzms) Thanks for your review. In the public repo, pull requests should be signed off by the author, another member of the content team, or a PM. M. Baldwin (@msmbaldwin) Could you take a look? Thanks! |
Why this change
The article describes encryption at host as though it were the default protection for Azure virtual machine disks. Azure managed disks use server-side encryption at rest by default, while encryption at host is an optional VM setting that extends protection to temporary disks, disk caches, and data flows between the compute host and Azure Storage.
Conflating these controls can cause readers to assume that host-level coverage is already enabled and deploy workloads without the protection they expect. The revised wording makes the default and optional controls explicit and directs readers to current support restrictions before enabling encryption at host.
What changed
Validation
articles/security/fundamentals/overview.md.git diff --check.References