Now what's critical to understand here is that all of this discussion we're
doing is not for BitLocker or whole volume encryption.
The SSE encryption, and again, we can do that by going over to Disks,
selecting the disk, and going to Encryption,
this is simply the at rest encryption,
when the VM is stopped and deallocated and the VHD is
at rest in the Azure datacenters.
So if we were to do an export and download this disk to our local computer,
it would be unencrypted.
Now let's step back, let's go back to Disks,
and this time let's go to Additional settings on the toolbar.
We have Azure Disk Encryption.
This is the BitLocker drive encryption for Azure VMs,
and this one, by contrast, you know this if you've used BitLocker,
the VM has to be awake and online and Windows needs
to be active in order to do this.
We choose whether we're going to encrypt just the OS
disk or the OS and data disks, and this,
in fact,
is going to be full volume encryption that even if you exported
the disk from the portal to your local machine,
you would need that key to unlock the disk.
Important point to consider.
So, speaking of which, we get the key by storing it in Key Vault.
We can either grab an existing key, or we can create a new one.
I'm going to grab acq‑bitlocker‑key, which is a key I've used in the past.
In Azure Key Vault,
you can version the different artifacts that you store in there.
You can store encryption keys, passwords,
or just what are called secrets, basically,
secure string data, as well as certificates.
And when you replace a version, all of those versions are hash computed,
so they're identified with a cryptographic hash,
and that's how you in Azure reference those versions.
See?
So this is all I have to do now.
But from a troubleshooting standpoint,
I'm going to want to make sure that I have privilege to be
able to read out this key from Key Vault.
So if I hit Save here, then the machine is going to restart.
That's something else you want to think about.
It will restart and apply whole volume encryption to that machine.
Important stuff.
Before we go to the next piece here,
let me just jump over to Key Vault and just mention as we drive
by in Key Vault that Azure Key Vault has a number of mechanisms
to protect you and your business,
particularly against a rogue or accidental deletion of a key.
See what I mean?
If we were to select this key and we have at least read/write privileges,
we can delete this key,
and that could potentially put us in a world of hurt with any related
Windows Server Azure VMs that are using the key.
Now notice that you can back up these keys.
However, the backups are encrypted to the Key Vault,
so that's of relatively limited use. Let me go into the current version just to show you what it looks like here.