{"id":944,"date":"2019-10-28T00:00:00","date_gmt":"2019-10-28T00:00:00","guid":{"rendered":"https:\/\/azure.microsoft.com\/blog\/preview-server-side-encryption-with-customer-managed-keys-for-azure-managed-disks"},"modified":"2025-06-26T10:31:27","modified_gmt":"2025-06-26T17:31:27","slug":"preview-server-side-encryption-with-customer-managed-keys-for-azure-managed-disks","status":"publish","type":"post","link":"https:\/\/azure.microsoft.com\/en-us\/blog\/preview-server-side-encryption-with-customer-managed-keys-for-azure-managed-disks\/","title":{"rendered":"Preview: Server-side encryption with customer-managed keys for Azure Managed Disks"},"content":{"rendered":"\n
\n

Updated on July 17, 2020<\/strong>: Server-side encryption with customer-managed keys is now generally available. For more information, see the blog post Announcing server-side encryption with customer-managed keys for Azure Managed Disks<\/a>.<\/p>\n

Today we\u2019re introducing the preview for server-side encryption (SSE) with customer-managed keys (CMK) for Azure Managed Disks<\/a>. Azure customers already benefit from server-side encryption with platform managed keys<\/a> (PMK) for Azure Managed Disks enabled by default. Customers also benefit from Azure disk encryption<\/a> (ADE) that leverages the BitLocker<\/a> feature of Windows and the DM-Crypt feature of Linux to encrypt Managed Disks with customer managed keys within the guest virtual machine.<\/p>\n

Server-side encryption with customer-managed keys improves on platform managed keys by giving you control of the encryption keys to meet your compliance needs. It improves on Azure disk encryption by enabling you to use any OS types and images for your virtual machines by encrypting data in the storage service. Server-side encryption with customer-managed keys is integrated with Azure Key Vault<\/a> (AKV) that provides highly available and scalable, secure storage for RSA cryptographic keys backed by hardware security modules (HSMs). You can either import your RSA keys<\/a> to Azure Key Vault or generate new RSA keys in Azure Key Vault.<\/p>\n

Azure Storage handles the encryption and decryption in a fully transparent fashion using envelope encryption<\/a>. It encrypts data using an Advanced Encryption Standard (AES) 256 based data encryption key which is in turn protected using your keys stored in Azure Key Vault. You have full control of your keys, and Azure Managed Disks uses system-assigned managed identity<\/a> in your Azure Active Directory for accessing keys in Azure Key Vault. A user with required permissions in Azure Key Vault must first grant permissions before Azure Managed Disks can access the keys. You can prevent Azure Managed Disks from accessing your keys by either disabling your keys or by revoking access controls for your keys. Moreover, you can track the key usage through Azure Key Vault monitoring to ensure that only Azure Managed Disks or other trusted Azure services are accessing your keys.<\/p>\n

To enable customer-managed keys for Azure Managed Disks, you must first create an instance of a new resource type called DiskEncryptionSet, which represents a customer-managed key. You must associate your disks, snapshots, and images with a DiskEncryptionSet to encrypt them with customer-managed keys. There is no restriction on the number of resources that can be associated with the same DiskEncryptionSet.<\/p>\n

\"SSE<\/figure>

<\/p>\n

Availability<\/h2>\n

Server-side encryption customer-managed keys are available for Standard HDD, Standard SSD, and Premium SSD Managed Disks. You can now perform the following operations in the West Central US region via Azure Compute Rest API version 2019-07-01:<\/p>\n