An older lock-chamber virtual machine must encrypt OS and data volumes inside the guest with BitLocker or dm-crypt and store encryption secrets in Key Vault. Which control should the security engineer select?

An older lock-chamber virtual machine that must encrypt OS and data volumes inside the guest with BitLocker or dm-crypt and store encryption secrets in Key Vault needs Azure Disk Encryption (ADE). ADE is the guest-level control that applies BitLocker on Windows or dm-crypt on Linux to OS and data volumes, with BitLocker encryption keys and optional key encryption keys integrated through Azure Key Vault. For civic workloads still on conventional VM sizes that specifically require in-guest volume encryption tied to Key Vault, ADE is the named match—not merely assuming platform SSE is enough.

Enabling encryption at host only because it “always encrypts volumes inside the guest OS with BitLocker” fails by concept: encryption at host protects data on the host path (including temp disks and caches) without running guest BitLocker/dm-crypt the way ADE does. Enabling confidential disk encryption on any D-series VM without choosing a confidential VM size fails because confidential disk encryption requires confidential VM SKUs and TPM binding; it is not a drop-in on arbitrary D-series sizes. Relying solely on platform-managed server-side encryption fails because SSE-at-rest does not implement guest-level BitLocker or dm-crypt with Key Vault-backed volume encryption secrets.

Exam caveat: ADE is guest BitLocker/dm-crypt + Key Vault; encryption at host is host-path encryption often preferred for new VMs; confidential disk encryption is a confidential-VM/TPM model—do not conflate the three. Operational check: confirm the chamber VM size and OS support ADE, enable ADE with Key Vault permissions for the disk encryption extension identity, validate OS and data volumes show encrypted, and record CPU impact and Key Vault access in the municipal operations runbook.