A reviewer closes a lock-chamber VM encryption finding because Azur…

Question

A reviewer closes a lock-chamber VM encryption finding because Azure Disk Storage server-side encryption with platform-managed keys is already on. What should the security engineer explain about that baseline versus Domain 3 disk encryption options?

Accepted Answer

Platform-managed SSE encrypts managed disks at rest by default but does not encrypt temporary disks or host caches the way ADE, encryption at host, or confidential disk encryption can address. — SSE-at-rest is the locked warehouse floor—always on for managed disks. Temp disks and host caches still need the extra locks: ADE, encryption at host, or confidential disk encryption.

Answer

Platform-managed SSE already encrypts temporary disks, host caches, and guest OS volumes, so ADE and encryption at host add no security value.

Answer

Platform-managed SSE is identical to Azure Disk Encryption because both run BitLocker inside the guest with keys in Key Vault.

Answer

Platform-managed SSE must be turned off before confidential disk encryption can bind an OS disk to the TPM.

A reviewer closes a lock-chamber VM encryption finding because Azure Disk Storage server-side encryption with platform-managed keys is already on. What should the security engineer explain about that baseline versus Domain 3 disk encryption options?

Short Explanation

Full Explanation