In this demonstration,
we're going to work entirely in Azure. We'll learn how to use
Azure Disk Encryption to manage BitLocker Drive Encryption in
the cloud rather than on‑premises, which is what we did in the previous demo.
I'm signed into the Azure portal.
It doesn't matter which machine I'm on. I'm on my local domain
controller, but as I said, it doesn't matter a bit. There's a few Azure
resources that we need to understand a bit about here.
Chiefly, we're going to start with Key Vault.
This is the main Azure resource for storing your secrets.
There's three types of secrets.
There's Keys, which are encryption keys, and this is
specifically what we want for our BitLocker use.
There's also Secrets, and this is just secure string data. It could be a
password or a connection string or something like that. And then we have
Certificates. These are TLS SSL certificates,
identity certificates, whatever. Those are the three types of artifacts.
Now Key Vault has been undergoing a C change with regard to authorization.
Notice that the permission model here can use either the access policy or
Azure RBAC. I'm not going to get into the weeds here.
We need to definitely understand Key Vault in great depth if you
want to take AZ‑500, the Azure Security Engineer certification
exam. I don't think it's a concern here.
The main thing that we need to do is make sure that our Access
policies blade for our key vault has this option here turned on,
Azure Disk Encryption for volume encryption. And that's going to
allow your disk encryption set to store a BitLocker key here in the
key store of the given key vault.
So next, let's create a disk encryption set, or a DES as I sometimes call it.
We'll click Create here in the portal, and I'm going to put it in my
az801‑rg, and I'm going to call this az801‑des. Note that this is
region‑bound, and the Encryption type can use, let's see, Encryption
at‑rest with a customer‑managed key as the default, Double encryption
using both platform and customer keys.
I'll just stay with the customer‑managed key.
And again,
one of the nice value props of using Key Vault is native
integration with other Azure services.
So, we can easily just select my key vault, and then we can
create or use an existing encryption key.
I'm going to call this az801‑des‑key. I'll leave
this at all the defaults right now.
That's fine.
And that's all we need for that.
So as I explained,
a disk encryption set is simply a channel, an
authenticated channel, that allows Azure to fetch an
encryption key securely from your key vault.
And you'll see next when we enable Azure Disk Encryption on an Azure
virtual machine that we will, again, use that DES, that disk encryption
set, in order to complete that configuration.
So speaking of which, let's head on over to Virtual machines.
I have a Windows server 2022 VM called win1.
Now note that configuring Azure Disk Encryption requires that the VM is
running. We saw that on‑prem that the BitLocker drive encryption wizard
does its work while the machine is up.
Same thing, if your VM is stopped and deallocated, you won't be
able to turn on or use Azure Disk Encryption.
Also again, I want to repeat that Azure Disk Encryption leaves the disk
encrypted If we do an export. Let me explain what I mean.
If I go here in the virtual machine properties, first
let me make sure that it's running.
Yes, it is.
If I go to Disks, we can see that I have one and only one OS disk, and
then I have a data disk as well on this virtual machine. That's fine.
We can use BitLocker on both of them.
If I were to want a copy of this C drive,
I could do a disk export in which Azure creates what's called a shared access
signature, or SAS, URL that expires after this time out here.
Now, that would mean that if we applied BitLocker, if we
applied Azure Disk Encryption, we wouldn't be able to use the
disk unless it was first unlocked.
So yes, this is BitLocker. It is whole volume,
whole disk encryption that travels with that underlying VHD, or virtual hard
disk. Now, sometimes confused with ADE, there's also a related VM storage
encryption technology in Azure called Storage Service Encryption, or SSE.
And this is simply Microsoft's attestation that your VHDs are encrypted at
rest in the Azure data center.
So if you do not use Azure Disk Encryption, but do use this, in
fact, you have to use Storage Service Encryption.
Really, the only question is whether you're going to let Microsoft manage
the encryption key or you're going to manage it yourself.
But as I was saying, if you do not have ADE turned on and you did an export,
those disks would be unencrypted.
This option here, the Storage Service Encryption, is only when the
VHD is at rest, that is when the virtual machine is stopped and
deallocated in the Azure virtual machines.
All right,
so let's go back to the Disks blade. And to get to our Azure
Disk Encryption option, we'll go to Additional settings, and we
want what's called Encryption settings right down here. We
specify the scope of encryption, which is either OS disk or OS and data disks.
I'm going to do both.
And then as I promised you, we have our Azure Key Vault.
Now you might be wondering, Tim, well, what about this disk encryption
set that you just were talking about and you just showed a moment ago?
Hold on. I'm going to circle back to that, but let me finish my
discussion here with Azure Disk Encryption.
We can select our key vault, choose our key. And again,
we're choosing a specific key here, aren't we?
And then in Key Vault, your keys can actually be versioned
and changed. Key Vault creates a hash for each one, and
that's literally all there is to it.
We click Save, and we're good to go. Now as it turns out, the disk
encryption set is used with your at‑rest disk encryption.
So if I come back to win1,
let me temporarily, you know, dump my changes, and let me quickly stop and
deallocate this virtual machine. That will detach the disks.
I want to go back to that Encryption blade so I can formally
show you where the disk encryption set fits in.
Okay, successfully stopped the virtual machine.
So let's go back to Disks, and let me choose that OsDisk now. And this time,
let me go to Encryption. By default, Microsoft takes care of the server‑side
encryption when the VHDs are in the data center.
However, note that we can do an encryption at rest with the customer‑managed key.
It is this case in which you choose your disk encryption set, and that would
be this at rest when the VHD is not in use in the Azure data center. Notice
that I can select my az801‑des disk encryption set, click Save, and we're good to go.