Encryption at host for Azure VM's

Question

I want to know if encryption at host is supported for all disk type or just for premium SSD and ultra disks?
does setting up encryption at host also need a key vault and disk encryption sets? are there any cost involved?
I know it does not use vm cpu but are there any other drawbacks/impact by enabling it? , like restoration of disks/VM, backup, etc.

Answer 1

Hello @Shivam Singh

Encryption at host is supported for all disk types in Azure, including standard HDD, standard SSD, premium SSD, and ultra disks. However, there are some restrictions on the VM sizes that support encryption at host, like Legacy VM Sizes aren't supported which you can find in the Azure documentation.

Setting up encryption at host does not require a key vault or disk encryption sets. However, if you want to use customer-managed keys (CMK) for encryption at host, you will need to create a key vault and configure it to use CMK. There may be additional costs associated with using CMK, depending on the key vault pricing and the number of keys you need to manage. Enabling encryption at host should not have a significant impact on disk or VM restoration, backup, or other operations. However, it is important to note that encryption at host does not protect against data loss due to accidental deletion, corruption, or other issues.

You should still follow best practices for data backup and recovery to ensure that your data is protected. One potential drawback of enabling encryption at host is that it may increase the time required to create or restore VMs, since the encryption process must be completed before the VM can be used. However, this should not have a significant impact on most workloads, and the benefits of encryption at host generally outweigh any potential drawbacks.

Ref: https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-host-based-encryption-portal?tabs=azure-powershell

Hope this helps, feel free to tag me in comments for any queries.

If I have answered your query, please click "Accept as answer" as a token of appreciation