Proposed Pull Request Change

📄 Document Links

View on GitHub View on Microsoft Learn

--- title: include file description: include file services: virtual-machines author: roygara ms.service: virtual-machines ms.topic: include ms.date: 04/17/2025 ms.author: rogarana ms.custom: include file, devx-track-azurepowershell # Customer intent: As a cloud security administrator, I want to configure Azure Key Vault and Disk Encryption Set so that I can securely manage encryption keys for our managed disks across multiple subscriptions in compliance with security policies. --- 1. Install the latest [Azure PowerShell version](/powershell/azure/install-azure-powershell), and sign in to your Azure account with [`Connect-AzAccount`](/powershell/module/az.accounts/connect-azaccount). 1. Create an instance of Azure Key Vault and encryption key. When creating the Key Vault instance, you must enable purge protection. Purge protection ensures that a deleted key cannot be permanently deleted until the retention period lapses. These settings protect you from losing data due to accidental deletion. These settings are mandatory when using a Key Vault for encrypting managed disks. ```powershell $ResourceGroupName="yourResourceGroupName" $LocationName="westcentralus" $keyVaultName="yourKeyVaultName" $keyName="yourKeyName" $keyDestination="Software" $diskEncryptionSetName="yourDiskEncryptionSetName" $keyVault = New-AzKeyVault -Name $keyVaultName ` -ResourceGroupName $ResourceGroupName ` -Location $LocationName ` -EnablePurgeProtection $key = Add-AzKeyVaultKey -VaultName $keyVaultName ` -Name $keyName ` -Destination $keyDestination Set-AzKeyVaultKeyRotationPolicy -VaultName $keyVaultName -KeyName $keyName -ExpiresIn P2Y -KeyRotationLifetimeAction @{Action="Rotate";TimeBeforeExpiry = "P18M"} ``` 1. Create a disk encryption set. This script sets RotationToLatestKeyVersionEnabled equal to $true to enable automatic rotation of the key. When you enable automatic rotation, the system automatically updates all managed disks, snapshots, and images referencing the disk encryption set to use the new version of the key within one hour. ```powershell $desConfig=New-AzDiskEncryptionSetConfig -Location $LocationName ` -SourceVaultId $keyVault.ResourceId ` -KeyUrl $key.Key.Kid ` -IdentityType SystemAssigned ` -RotationToLatestKeyVersionEnabled $true $des=New-AzDiskEncryptionSet -Name $diskEncryptionSetName ` -ResourceGroupName $ResourceGroupName ` -InputObject $desConfig ``` 1. Grant the disk encryption set access to the key vault. > [!NOTE] > It might take a few minutes for Azure to create the identity of your disk encryption set in Microsoft Entra ID. If you get an error like "Cannot find the Active Directory object" when running the following command, wait a few minutes and try again. ```powershell Set-AzKeyVaultAccessPolicy -VaultName $keyVaultName -ObjectId $des.Identity.PrincipalId -PermissionsToKeys wrapkey,unwrapkey,get ``` ### Use a key vault in a different subscription Alternatively, you can manage your Azure Key Vaults centrally from a single subscription, and use the keys stored in the Key Vault to encrypt managed disks and snapshots in other subscriptions in your organization. This allows your security team to enforce and easily manage a robust security policy to a single subscription. > [!IMPORTANT] > For this configuration, both your Key Vault and your disk encryption set must be in the same region and be using the same tenant. The following script is an example of how you would configure a disk encryption set to use a key from a Key Vault in a different subscription, but same region: ```azurepowershell $sourceSubscriptionId="<sourceSubID>" $sourceKeyVaultName="<sourceKVName>" $sourceKeyName="<sourceKeyName>" $targetSubscriptionId="<targetSubID>" $targetResourceGroupName="<targetRGName>" $targetDiskEncryptionSetName="<targetDiskEncSetName>" $location="<targetRegion>" Set-AzContext -Subscription $sourceSubscriptionId $key = Get-AzKeyVaultKey -VaultName $sourceKeyVaultName -Name $sourceKeyName Set-AzContext -Subscription $targetSubscriptionId $desConfig=New-AzDiskEncryptionSetConfig -Location $location ` -KeyUrl $key.Key.Kid ` -IdentityType SystemAssigned ` -RotationToLatestKeyVersionEnabled $true $des=New-AzDiskEncryptionSet -Name $targetDiskEncryptionSetName ` -ResourceGroupName $targetResourceGroupName ` -InputObject $desConfig ```