VMs and VMSS should have encryption at host enabled

What does this mean?

Encryption at host ensures that data stored on the VM host (including temp disks and disk caches) is encrypted at rest. This provides an additional layer of encryption beyond Azure Storage encryption.

Benefits of implementation

• Encrypts temp disks and caches that are not covered by standard disk encryption
• Data is encrypted before it leaves the compute host
• Required by various compliance frameworks

Drawbacks and considerations

• Not supported on all VM sizes
• Cannot be enabled on existing VMs without redeployment in some cases
• Slight performance overhead for encryption/decryption

Implementation

Implementation guidance coming soon.

Related recommendations

Related recommendations will be linked here.