VM and backup disk encryption: SSE with CMK vs PMK vs ADE vs encryption at host
Verdict: Use server-side encryption with customer-managed keys for key custody independent of the guest boot. Platform-managed keys give no control. Azure Disk Encryption runs in-guest and is being retired for encryption at host.
| Criterion | SSE with platform-managed keys | SSE with customer-managed keys | Azure Disk Encryption | Encryption at host |
|---|---|---|---|---|
| Key control | Microsoft controls and rotates | Customer controls, rotates and revokes in Key Vault | In-guest BitLocker or DM-Crypt keys | Storage-service applied |
| Independent of guest OS boot | Yes | Yes | No; runs inside the guest boot | Yes, at the host level |
| Covers temp disk and cache | OS and data disks | OS and data disks | OS and data disks | OS, data, cache and temp disks |
| Choose when | Default baseline, no custody need | Regulated key rotation and revocation evidence | Legacy requirement only | New workloads; Microsoft's recommended direction |
Rules
- Choose customer-managed keys in Key Vault when a regulated customer must control and rotate keys, including revocation, for backup or disk data.
- For keys managed independently of the guest OS boot, use server-side encryption with customer-managed keys, not in-guest Azure Disk Encryption.
- Server-side encryption (platform- or customer-managed) and encryption at host are the currently supported approaches; encryption at host also covers cache and temp disks.
Traps
- Platform-managed keys are controlled entirely by Microsoft, so the organisation cannot rotate them itself - failing a key-custody requirement.
- Azure Disk Encryption operates inside the guest boot sequence and Microsoft recommends migrating off it to encryption at host.
- Azure Disk Encryption on the source VM does not govern the backup vault's data-at-rest key; use a customer-managed key for that.