Proposed Pull Request Change

📄 Document Links

View on GitHub View on Microsoft Learn

--- title: Azure Disk Encryption and Azure Virtual Machine Scale Sets extension sequencing description: In this article, learn how to enable Microsoft Azure Disk Encryption for Linux IaaS VMs. author: iamwilliew ms.author: wwilliams ms.topic: how-to ms.service: azure-virtual-machine-scale-sets ms.subservice: disks ms.date: 05/19/2026 ms.reviewer: mimckitt ms.custom: mimckitt, linux-related-content # Customer intent: As an Azure administrator, I want to implement Azure Disk Encryption in a specific sequence with other extensions for my Linux IaaS VMs, so that I can ensure data security while preparing the disks appropriately before use. --- # Use Azure Disk Encryption with Virtual Machine Scale Set extension sequencing [!INCLUDE [Azure Disk Encryption retirement notice](~/reusable-content/ce-skilling/azure/includes/security/azure-disk-encryption-retirement.md)] Extensions such as Azure disk encryption can be added to an Azure virtual machines scale set in a specified order. To do so, use [extension sequencing](virtual-machine-scale-sets-extension-sequencing.md). In general, encryption should be applied to a disk: - After extensions or custom scripts that prepare the disks or volumes. - Before extensions or custom scripts that access or consume the data on the encrypted disks or volumes. In either case, the `provisionAfterExtensions` property designates which extension should be added later in the sequence. ## Sample Azure templates If you wish to have Azure Disk Encryption applied after another extension, put the `provisionAfterExtensions` property in the AzureDiskEncryption extension block. Here is an example using "CustomScriptExtension", a PowerShell script that initializes and formats a Windows disk, followed by "AzureDiskEncryption": ```json "virtualMachineProfile": { "extensionProfile": { "extensions": [ { "type": "Microsoft.Compute/virtualMachineScaleSets/extensions", "name": "CustomScriptExtension", "location": "[resourceGroup().location]", "properties": { "publisher": "Microsoft.Compute", "type": "CustomScriptExtension", "typeHandlerVersion": "1.9", "autoUpgradeMinorVersion": true, "forceUpdateTag": "[parameters('forceUpdateTag')]", "settings": { "fileUris": [ "https://raw.githubusercontent.com/Azure-Samples/compute-automation-configurations/master/ade-vmss/FormatMBRDisk.ps1" ] }, "protectedSettings": { "commandToExecute": "powershell -ExecutionPolicy Unrestricted -File FormatMBRDisk.ps1" } } }, { "type": "Microsoft.Compute/virtualMachineScaleSets/extensions", "name": "AzureDiskEncryption", "location": "[resourceGroup().location]", "properties": { "provisionAfterExtensions": [ "CustomScriptExtension" ], "publisher": "Microsoft.Azure.Security", "type": "AzureDiskEncryption", "typeHandlerVersion": "2.2", "autoUpgradeMinorVersion": true, "forceUpdateTag": "[parameters('forceUpdateTag')]", "settings": { "EncryptionOperation": "EnableEncryption", "KeyVaultURL": "[reference(variables('keyVaultResourceId'),'2018-02-14-preview').vaultUri]", "KeyVaultResourceId": "[variables('keyVaultResourceID')]", "KeyEncryptionKeyURL": "[parameters('keyEncryptionKeyURL')]", "KekVaultResourceId": "[variables('keyVaultResourceID')]", "KeyEncryptionAlgorithm": "[parameters('keyEncryptionAlgorithm')]", "VolumeType": "[parameters('volumeType')]", "SequenceVersion": "[parameters('sequenceVersion')]" } } }, ] } } ``` If you wish to have Azure Disk Encryption applied before another extension, put the `provisionAfterExtensions` property in the block of the extension to follow. Here is an example using "AzureDiskEncryption" followed by "VMDiagnosticsSettings", an extension that provides monitoring and diagnostics capabilities on a Windows-based Azure VM: ```json "virtualMachineProfile": { "extensionProfile": { "extensions": [ { "name": "AzureDiskEncryption", "type": "Microsoft.Compute/virtualMachineScaleSets/extensions", "location": "[resourceGroup().location]", "properties": { "publisher": "Microsoft.Azure.Security", "type": "AzureDiskEncryption", "typeHandlerVersion": "2.2", "autoUpgradeMinorVersion": true, "forceUpdateTag": "[parameters('forceUpdateTag')]", "settings": { "EncryptionOperation": "EnableEncryption", "KeyVaultURL": "[reference(variables('keyVaultResourceId'),'2018-02-14-preview').vaultUri]", "KeyVaultResourceId": "[variables('keyVaultResourceID')]", "KeyEncryptionKeyURL": "[parameters('keyEncryptionKeyURL')]", "KekVaultResourceId": "[variables('keyVaultResourceID')]", "KeyEncryptionAlgorithm": "[parameters('keyEncryptionAlgorithm')]", "VolumeType": "[parameters('volumeType')]", "SequenceVersion": "[parameters('sequenceVersion')]" } } }, { "name": "Microsoft.Insights.VMDiagnosticsSettings", "type": "extensions", "location": "[resourceGroup().location]", "apiVersion": "2016-03-30", "dependsOn": [ "[concat('Microsoft.Compute/virtualMachines/myVM', copyindex())]" ], "properties": { "provisionAfterExtensions": [ "AzureDiskEncryption" ], "publisher": "Microsoft.Azure.Diagnostics", "type": "IaaSDiagnostics", "typeHandlerVersion": "1.5", "autoUpgradeMinorVersion": true, "settings": { "xmlCfg": "[base64(concat(variables('wadcfgxstart'), variables('wadmetricsresourceid'), concat('myVM', copyindex()), variables('wadcfgxend')))]", "storageAccount": "[variables('storageName')]" }, "protectedSettings": { "storageAccountName": "[variables('storageName')]", "storageAccountKey": "[listkeys(variables('accountid'), '2015-06-15').key1]", "storageAccountEndPoint": "https://core.windows.net" } } }, ] } } ``` For a more in-depth template, see: * Apply the Azure Disk Encryption extension after a custom shell script that formats the disk (Linux): [deploy-extseq-linux-ADE-after-customscript.json](https://github.com/Azure-Samples/compute-automation-configurations/blob/master/ade-vmss/deploy-extseq-linux-ADE-after-customscript.json) ## Next steps - Learn more about extension sequencing: [Sequence extension provisioning in Virtual Machine Scale Sets](virtual-machine-scale-sets-extension-sequencing.md). - Learn more about the `provisionAfterExtensions` property: [Microsoft.Compute virtualMachineScaleSets/extensions template reference](/azure/templates/microsoft.compute/2022-08-01/virtualmachinescalesets/extensions). - [Azure Disk Encryption for Virtual Machine Scale Sets](disk-encryption-overview.md) - [Encrypt a Virtual Machine Scale Sets using the Azure CLI](disk-encryption-cli.md) - [Encrypt a Virtual Machine Scale Sets using the Azure PowerShell](disk-encryption-powershell.md) - [Create and configure a key vault for Azure Disk Encryption](disk-encryption-key-vault.md)