Now let's consider troubleshooting Azure VM disk encryption issues.
Before we get into BitLocker and Azure disk encryption though,
let's take a brief look at the Azure Virtual Machine storage subsystem.
First of all,
I want to make sure that you're using managed disks and not unmanaged disks.
In other words, you're VHDs, or virtual hard disks,
that comprise the OS and data disks of your Azure VMs should
not be in the blob service of a storage account, but instead
in the disk's service. Number two,
you may find that you run into issues when performing operations or attempting
to perform operations on those managed disks. Nine times out of 10, that's
normally a lease or a lock issue that's happening where Azure has the disk
locked for exclusive access. If you or a colleague attempts an export, export
is basically where you're downloading a copy of the VHD, until that SAS
expires, that VHD is going to be locked and inaccessible. You won't be able to
delete it, for example.
Also, the run state of the VM is very important. When you're implementing
Azure disk encryption, the VM has to be powered on and the disk has to be
attached. When you're doing server‑side encryption, that's the built‑in,
at‑rest encryption that Microsoft provides in their data centers, and you
want to go, say, from using Microsoft‑managed keys to customer‑managed keys,
there it's just the opposite.
You need to stop and de‑allocate the virtual machine and release all locks on the VHD in order to change the SSC setting.