Unable to Enable Encryption at host for Azure VM

Question

I'm attempting to enable Encryption at host for a virtual machine (VM) in Azure. I've confirmed that the "Microsoft.Compute" resource provider is registered in my Azure subscription, and when I run the necessary command to verify, it shows as registered. However, when I try to enable encryption at the host level for the VM's disk, I encounter the following error:

Failed to update 'abc-vm'. Error: The property 'securityProfile.encryptionAtHost' is not valid because the 'Microsoft.Compute/EncryptionAtHost' feature is not enabled for this subscription   

Any guidance or assistance would be greatly appreciated.

Answer 1

You must enable the feature for your subscription before you can use encryption at host for either your VM or Virtual Machine Scale Set. Use the following steps to enable the feature for your subscription:

Azure portal: Select the Cloud Shell icon on the Azure portal:.

Execute the following command to register the feature for your subscription:

Register-AzProviderFeature -FeatureName "EncryptionAtHost" -ProviderNamespace "Microsoft.Compute"

Confirm that the registration state is Registered (registration may take a few minutes) using the following command before trying out the feature.

Get-AzProviderFeature -FeatureName "EncryptionAtHost" -ProviderNamespace "Microsoft.Compute"

https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-host-based-encryption-portal?tabs=azure-powershell#prerequisites

Hopefully this will resolve your issue.

Please click "Accept as answer" if this helps.

Answer 2

Hi Tahami Rizwan

Did you check if the feature is enabled for the correct subscription id?
In case of multiple subscriptions, you need to set the subscription context and then run the following

az feature register --namespace Microsoft.Compute --name EncryptionAtHost
https://learn.microsoft.com/en-us/azure/virtual-machines/linux/disks-enable-host-based-encryption-cli#prerequisites

If you continue to see the same error, I recommend you open an Azure support case and Azure technical support team will be able to further investigate the issue and help with this. If you don't have the ability to open a technical support ticket, please let me know and I can help you further with this.