Azure Disk Encryption, or ADE for short. ADE is simply a
BitLocker solution for Windows VMs in Azure. Now,
if you've got experience with Azure Resource Manager,
you know that the way it handles virtual machines is pretty
identical regardless of whether you're running Windows Server
or an endorsed Linux distribution.
So we can do ADE for Linux VMs in Azure as well, but note that
there you're using the dm‑crypt library, of course,
because BitLocker is specific only to Microsoft Windows.
Now another wrinkle with Azure Disk Encryption is where to store
the recovery key because your VMs don't have access to a TPM chip
on a hard, you know, a hardware chip on a hardware motherboard like
your servers may on‑prem, even from a virtual machine standpoint, a
virtual TPM. No, it's different from that.
Instead, your recovery key is going to be stored in Azure Key Vault,
which I hope you're using anyway because it provides a really
nice, safe way to store all of your secrets.
In other words,
secure string data, encryption keys, as well as digital certificates.
And using Azure Resource Manager and the Key Vault API, you can easily
fetch those and use them in your code,
your solutions, etc. Now some additional points that may
show up on your exam, kind of trivia,
but, I mean, they have real‑world implications.
Your Azure VMs need to be configured a bit differently
from your on‑premises VMs. First of all,
Azure VMs have to be configured to use 256‑bit recovery keys.
You can do that in Group Policy. And if you're in a hybrid cloud with, say, an
ExpressRoute circuit or a site‑to‑site VPN and you've domain joined those Azure
Windows Server VMs, make sure that they're not getting GPOs pushed to them that
specify TPM enforcement because, again, that's not part of the deal.
That is to say you're just strictly using Azure Key Vault for
your recovery key. Here I've created, again,
a lucid chart diagram that shows you the Azure resources involved in an
Azure Disk Encryption solution. So we can have, starting from left to
right, looking at a Windows Server VM running in Azure. We've got one
and only one operating system disk and zero or more data disks.
Depending upon the VM size, different VM sizes support different maximum
numbers of data disks.
You'll see in the demo that when you enable Azure Disk Encryption,
you can choose to encrypt only the OS disk or the OS disk and all data disks.
But here's a really big exam alert and reality check for you. Microsoft
doesn't have you go directly from the VM disks into Key Vault.
There's an intermediary resource necessary called the disk encryption set, and
basically, that's simply a resource that maps into Key Vault.
In other words,
you generate an encryption key, a 256 AES key, that will live in Key
Vault, and the disk encryption set is mapped to that key. And then,
when you enable ADE on one or more VMs, you can either share the same DES key,
or you can create different disk encryption sets
depending upon your needs and so on, but you can share one key for convenience here.