Now Azure disk encryption for Windows Server VMs in Azure is
basically an Azure‑hosted BitLocker solution.
Now,
what do you need to know about this from a troubleshooting
lens and for success on your AZ‑801 exam?
Well, number one, ADE isn't available for Azure VM sizes.
I mentioned in the previous module, the importance of
staying on top of not only the Azure docs,
but also what Microsoft calls ACOM, or azure.com.
I also call those the marketing pages.
This is where you can look up pricing and see what
availability is there for each of those VM sizes.
And frankly, again to repeat for review what I said in the previous module,
not every Azure service or feature may be available in all regions as well.
You should know that as of this recording in Summer 2022,
ADE supports only Generation 1 and not Generation 2 VHDs.
If you're doing hybrid administration,
particularly if you're joining your Windows Server Azure VMs to an
on‑premises Active Directory domain through,
say, an ExpressRoute circuit or a site‑to‑site VPN, please,
please, please,
be careful not to push Group Policy Objects that enforce BitLocker protectors,
particularly the Trusted Platform Module, or TPM. Why?
Well, you might know if you've ever implemented Azure Disk Encryption,
you're storing that encryption key in Azure Key Vault. And there's
actually another layer of abstraction, the, well, it's changed its name.
I'll show you in the demo; I can't remember what the new name is off the
top of my head. Microsoft, as you know,
especially in Azure, tends to change these product names pretty regularly, but
bottom line is, make sure that you leave Azure to control the state of volume
encryption in those Azure VMs, very important.
And then lastly, from a firewall standpoint,
those Azure VMs need to be able to reach the Azure
virtual IP or wire server, 168.63.129.16.
That shouldn't be a problem because it's through that virtual
IP that your Azure VMs do their agent heartbeat and a whole
bunch of other network services.
But, if for whatever reason, the Azure VMs can't get to the wire server
endpoint, that's big problems here for disk encryption and VM access.
Also, you'll need the VM to be able to reach the instance metadata
service endpoint. This is a mechanism that allows the VM to gain access
tokens on its own behalf.
You know how in Azure AD, we have the system‑assigned managed
identities and user‑assigned managed identities.
Now that's a link‑local IPv4 address. Access shouldn't be a problem, but just for completeness, I want to mention that here.