01 Run keyvault create command (Windows/macOS/Linux) to create the Microsoft Azure Key Vault where the required customer-managed key (BYOK) will be placed. Make sure that you set the --enabled-for-disk-encryption parameter to true for VM disk encryption support:
az keyvault create
--name cc-prod-key-vault
--resource-group cloud-shell-storage-westeurope
--location westeurope
--enable-soft-delete true
--enable-purge-protection true
--enabled-for-disk-encryption true
02 The command output should return the configuration metadata for the newly created Azure Key Vault:
{
"id": "/subscriptions/abcdabcd-1234-abcd-1234-abcd1234abcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.KeyVault/vaults/cc-prod-key-vault",
"location": "westeurope",
"name": "cc-prod-key-vault",
"properties": {
"accessPolicies": [
{
"applicationId": null,
"objectId": "1234abcd-1234-abcd-1234-abcd1234abcd",
"permissions": {
"certificates": [
"get",
"list",
"delete",
"create",
"import",
"update",
"managecontacts",
"getissuers",
"listissuers",
"setissuers",
"deleteissuers",
"manageissuers",
"recover"
],
"keys": [
"get",
"create",
"delete",
"list",
"update",
"import",
"backup",
"restore",
"recover"
],
"secrets": [
"get",
"list",
"set",
"delete",
"backup",
"restore",
"recover"
],
"storage": [
"get",
"list",
"delete",
"set",
"update",
"regeneratekey",
"setsas",
"listsas",
"getsas",
"deletesas"
]
},
"tenantId": "1234abcd-1234-abcd-1234-abcd1234abcd"
}
],
"createMode": null,
"enablePurgeProtection": true,
"enableSoftDelete": true,
"enabledForDeployment": false,
"enabledForDiskEncryption": true,
"enabledForTemplateDeployment": null,
"networkAcls": null,
"provisioningState": "Succeeded",
"sku": {
"name": "standard"
},
"tenantId": "1234abcd-1234-abcd-1234-abcd1234abcd",
"vaultUri": "https://cc-prod-key-vault.vault.azure.net/"
},
"resourceGroup": "cloud-shell-storage-westeurope",
"tags": {},
"type": "Microsoft.KeyVault/vaults"
}
03 Run keyvault key create command (Windows/macOS/Linux) to create the customer-managed key (Bring Your Own Key - BYOK), required to encrypt your Azure virtual machine disk volume(s):
az keyvault key create
--name cc-prod-byok-key
--vault-name cc-prod-key-vault
--kty RSA
--size 2048
--ops decrypt encrypt sign unwrapKey verify wrapKey
--expires "2020-10-29T10:30:00Z"
--protection software
--disabled false
04 The command output should return the configuration metadata for the new encryption key:
{
"attributes": {
"created": "2019-10-29T12:55:52+00:00",
"enabled": true,
"expires": "2020-10-29T10:30:00+00:00",
"notBefore": null,
"recoveryLevel": "Purgeable",
"updated": "2019-10-29T12:55:52+00:00"
},
"key": {
"crv": null,
"d": null,
"dp": null,
"dq": null,
"e": "AQAB",
"k": null,
"keyOps": [
"decrypt",
"encrypt",
"sign",
"unwrapKey",
"verify",
"wrapKey"
],
"kid": "https://cc-prod-key-vault.vault.azure.net/keys/cc-prod-byok-key/abcdabcdabcdabcdabcdabcdabcdabcd",
"kty": "RSA",
"n": " ... ",
"p": null,
"q": null,
"qi": null,
"t": null,
"x": null,
"y": null
},
"managed": null,
"tags": null
}
05 Run vm encryption enable command (Windows/macOS/Linux) using the ID of the virtual machine that you want to reconfigure (see Audit section part II to identify the right VM) as identifier parameter, to enable encryption at rest for the disk volume(s) attached to the selected virtual machine, using the customer-managed key (i.e. BYOK) created at the previous steps:
az vm encryption enable
--ids "/subscriptions/abcdabcd-1234-abcd-1234-abcd1234abcd/resourceGroups/CLOUD-SHELL-STORAGE-WESTEUROPE/providers/Microsoft.Compute/virtualMachines/cc-web-production-vm"
--disk-encryption-keyvault cc-prod-key-vault
--key-encryption-key cc-prod-byok-key
--key-encryption-keyvault cc-prod-key-vault
--volume-type ALL
06 If the command request was successful, the command output should return a confirmation message, such as:
The encryption request was accepted. Please use 'show' command to monitor the progress.
07 Run vm encryption show command (Windows/macOS/Linux) using the ID of the reconfigured Azure virtual machine (VM) as identifier parameter to confirm the encryption status by listing the URL of the customer-managed key used for disk volumes encryption:
az vm encryption show
--ids "/subscriptions/abcdabcd-1234-abcd-1234-abcd1234abcd/resourceGroups/CLOUD-SHELL-STORAGE-WESTEUROPE/providers/Microsoft.Compute/virtualMachines/cc-web-production-vm"
--query 'disks[*].encryptionSettings[*].keyEncryptionKey.keyUrl[]'
08 The command output should return the requested customer-managed key (BYOK) URL:
[
"https://cc-prod-key-vault.vault.azure.net/keys/cc-prod-byok-key/abcdabcdabcdabcdabcdabcdabcdabcd"
]
09 If required, repeat steps no. 5 – 8 for other Azure virtual machines available within the selected subscription.
10 Repeat steps no. 1 – 9 for each subscription available in your Microsoft Azure cloud account.
Security 