Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Important
Azure Disk Encryption is scheduled for retirement on September 15, 2028. Until that date, you can continue to use Azure Disk Encryption without disruption. On September 15, 2028, ADE-enabled workloads will continue to run, but encrypted disks will fail to unlock after VM reboots, resulting in service disruption.
Use encryption at host for new VMs, or consider Confidential VM sizes with OS disk encryption for confidential computing workloads. All ADE-enabled VMs (including backups) must migrate to encryption at host before the retirement date to avoid service disruption. See Migrate from Azure Disk Encryption to encryption at host for details.
Applies to: ✔️ Windows VMs
You can create Azure virtual machines (VMs) through the Azure portal. The Azure portal is a browser-based user interface to create VMs and their associated resources. In this quickstart, you use the Azure portal to deploy a Windows virtual machine, create a key vault for the storage of encryption keys, and encrypt the VM.
If you don't have an Azure subscription, create a free account before you begin.
Sign in to Azure
Sign in to the Azure portal.
Create a virtual machine
Select Create a resource in the upper left corner of the Azure portal.
On the New page, under Popular, select Windows Server 2016 Datacenter.
On the Basics tab, under Project details, make sure the correct subscription is selected.
For Resource group, select Create new. Enter myResourceGroup as the name and select OK.
For Virtual machine name, enter MyVM.
For Region, select (US) East US.
Verify that the Size is Standard D2s v3.
Under Administrator account, select Password. Enter a user name and a password.
Warning
The "Disks" tab features an "Encryption Type" field under Disk options. This field is used to specify encryption options for managed disks + CMK, not for Azure Disk Encryption.
To avoid confusion, we suggest you skip the Disks tab entirely while completing this tutorial.
Select the Management tab and verify that you have a diagnostics storage account. If you have no storage accounts, select Create new, give your new account a name, and select OK.
Select Review + create.
On the Create a virtual machine page, you can see the details about the VM you're about to create. When you're ready, select Create.
It takes a few minutes to deploy your VM. When the deployment is finished, move on to the next section.
Encrypt the virtual machine
When the VM deployment is complete, select Go to resource.
On the left-hand sidebar, select Disks.
On the top bar, select Additional settings.
Under Encryption settings > Disks to encrypt, select OS and data disks.
Under Encryption settings, select Select a key vault and key for encryption.
On the Select key from Azure Key Vault screen, select Create new.
To the left of Key vault and key, select Click to select a key.
On the Select key from Azure Key Vault, under the Key Vault field, select Create new.
On the Create key vault screen, ensure that the resource group is myResourceGroup, and give your key vault a name. Every key vault in Azure must have a unique name.
On the Access policies tab, check the Azure Disk Encryption for volume encryption box.
Select Review + create.
After the key vault passes validation, select Create. You return to the Select key from Azure Key Vault screen.
Leave the Key field blank and choose Select.
At the top of the encryption screen, select Save. A pop-up warns you that the VM reboots. Select Yes.
Clean up resources
When you no longer need these resources, you can delete the resource group, virtual machine, and all related resources. To delete these resources, select the resource group for the virtual machine, select Delete, and then confirm the name of the resource group to delete.
Next steps
In this quickstart, you created a key vault that was enabled for encryption keys, created a virtual machine, and enabled the virtual machine for encryption.