A contractor tries to enable encryption at host on a lock-chamber VM that already uses Azure Disk Encryption. What should the security engineer tell them?

When a contractor tries to enable encryption at host on a lock-chamber VM that already uses Azure Disk Encryption, the security engineer must state that ADE and encryption at host are mutually exclusive on a virtual machine. There is no supported pattern that simply stacks both on the same disks for defense in depth. Remediation is to move to new disks or new VMs configured for encryption at host (often preferred for new deployments) rather than flipping both switches on the existing ADE-protected chamber. Municipal change windows should treat this as a migration, not a portal toggle.

Enabling both controls together so BitLocker and host encryption stack fails by concept because Microsoft documents the two as mutually exclusive on one VM. Converting ADE to encryption at host in place with a single portal toggle that preserves the existing encrypted disks fails because there is no supported in-place conversion that leaves ADE disks as-is while simply enabling host encryption. Keeping ADE and adding confidential disk encryption on the same non-confidential VM to replace encryption at host fails because confidential disk encryption requires confidential VM sizing and is not a substitute enablement path for encryption at host on an ADE VM.

Exam caveat: know ADE versus encryption at host mutual exclusion and that migration uses new disks or VMs; current guidance often prefers encryption at host for new builds while ADE remains an exam-named guest option. Operational check: inventory ADE-enabled lock VMs, plan cutover to new disks/VMs with encryption at host if that is the target model, validate ADE is removed from the migration path, and update the canal runbook so contractors stop attempting dual enablement.