A lock-controller VM must keep its OS disk sealed so the host and h…

Question

A lock-controller VM must keep its OS disk sealed so the host and hypervisor cannot read it. Which approach meets that requirement?

Accepted Answer

Deploy a confidential virtual machine size and enable confidential disk encryption so the OS disk is bound to the TPM. — If the dockmaster’s safe must stay shut even from the pier crew, you need a confidential VM and confidential disk encryption—OS disk sealed to the TPM, not just ADE on a regular box.

Answer

Enable Azure Disk Encryption on a standard D-series VM and treat BitLocker as TPM-bound confidential disk encryption.

Answer

Enable encryption at host alone so the hypervisor is cryptographically barred from reading the OS disk.

Answer

Turn on platform-managed SSE with a double encryption toggle and skip confidential VM sizing.

A lock-controller VM must keep its OS disk sealed so the host and hypervisor cannot read it. Which approach meets that requirement?

Short Explanation

Full Explanation