Skip to content

Correct the encryption-at-host default #128679

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Brian Santacruz (bsantacruzms) wants to merge 2 commits into from
+2 −2
Closed

Correct the encryption-at-host default #128679

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0cbf72e
R01: Correct the encryption-at-host default
bsantacruzms Aug 3, 2026
23beb33
Address encryption guidance review feedback
bsantacruzms Aug 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions articles/security/fundamentals/overview.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ author: msmbaldwin
ms.service: security
ms.subservice: security-fundamentals
ms.topic: article
ms.date: 07/20/2026
ms.date: 08/03/2026
ms.author: mbaldwin
ai-usage: ai-assisted

Expand Down Expand Up @@ -434,7 +434,7 @@ For comprehensive threat detection capabilities across Azure, see [Azure threat

### VM disk encryption

By default, [encryption at host](/azure/virtual-machines/disk-encryption) helps you encrypt your IaaS virtual machine disks. It provides server-side encryption at the VM host level through AES 256 encryption, which is FIPS 140-2 compliant. This encryption occurs without consuming VM CPU resources and provides end-to-end encryption for temporary disks, OS/data disk caches, and data flows to Azure Storage. By default, it uses platform-managed keys with no extra configuration required. Optionally, you can configure the solution with customer-managed keys stored in Azure Key Vault or Azure Key Vault Managed HSM when you need to control and manage your own disk-encryption keys. The solution ensures that all data on the virtual machine disks is encrypted at rest in your Azure storage. For more information on key management options, see [Key management in Azure](key-management.md).
Azure managed disks use [server-side encryption](/azure/virtual-machines/disk-encryption) at rest by default. Encryption at host is an optional virtual machine setting that extends encryption to temporary disks, OS and data disk caches, and data flows between the compute host and Azure Storage. Review supported VM sizes and restrictions before enabling encryption at host. You can use platform-managed keys or configure customer-managed keys stored in Azure Key Vault or Azure Key Vault Managed HSM. For more information, see [Overview of managed disk encryption options](/azure/virtual-machines/disk-encryption-overview) and [Key management in Azure](key-management.md).

@bsantacruzms Brian Santacruz (bsantacruzms) Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in 23beb33. The link text now points to the managed disk encryption overview, and the detailed article is separately labeled "Server-side encryption of Azure managed disks."

@bsantacruzms Brian Santacruz (bsantacruzms) Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Addressed in 23beb33. "Supported VM sizes and restrictions" now links directly to the encryption-at-host restrictions section. I also verified that the destination and section anchor are live.


### Azure Resource Manager

Expand Down