Advisor keeps recommending settings done

Hello Cesar Rodriguez,

The correct procedure for encrypting a disk on a Linux virtual machine:

As your Virtual Machine is already created, you can Enable encryption on an existing or running Linux VM: Enable encryption on an existing or running Linux VM

Please check the supported VM's and Operating systems which supports Azure Disk Encryption: Azure Disk Encryption for Linux VMs, Create and encrypt a Linux VM with the Azure CLI

Please check this document to enable Azure Disk Encryption for Windows VM: Azure Disk Encryption scenarios on Windows VMs

Based on the screenshots you shared, it seems that Encryption at Host is enabled, but Azure Disk Encryption (ADE) is not. Azure Advisor checks for either one of these to be enabled, but sometimes it may still flag the recommendation even if Encryption at Host is properly configured

Check the current encryption status:

az vm encryption show --resource-group YourResourceGroup --name YourVMName

Even though the OS disk shows Encryption at Host: Enabled, the data disk might not be encrypted. Advisor will flag the entire VM if any attached disk lacks encryption.

Advisor Policy might mismatch, the Azure Policy used by Advisor may not recognize Encryption at Host as satisfying the encryption requirement. Advisor might be looking specifically for Azure Disk Encryption (using Key Vault keys) rather than host-based encryption.

Check the Azure policy definition to see if it is configured to check for Encryption at Host: Within the Azure Policy service, go to the "Definitions" section.​ Use the search bar to find policies related to encryption. For instance, you can search for "encryption at host" or "disk encryption".​ One relevant built-in policy is titled "Virtual machines and virtual machine scale sets should have encryption at host enabled". This policy audits whether encryption at host is enabled for your virtual machines and scale sets.

If you have any further queries, please do let us know. If the answer is helpful, please click "Accept Answer" and "Upvote it"

Thank you.

As mentioned, the VMs are already encrypted as shown in the attached image. However, Azure Advisor continues to request encryption despite this.

Could you please assist in resolving this issue?

Hi Cesar Rodriguez

Thanks for the response back.

It seems that even if you have enabled Encryption at Host for your VM, Azure Advisor may still flag it as not enabled due to specific conditions or configurations that might not be met. This could include the VM's compatibility with the encryption features or other settings that Azure Advisor checks.

If you are certain that Encryption at Host is correctly configured, you might consider exempting the recommendation if it does not apply to your situation

https://learn.microsoft.com/en-us/azure/virtual-desktop/azure-advisor-recommendations

https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption#encryption-at-host---end-to-end-encryption-for-your-vm-data

If the comment is helpful, please click "Upvote it".

Hi Cesar Rodriguez

Just want to check if the above comment worked for you or else please let us know if any help, we are always here to help whenever you need us.

If the comment is helpful, please click "Upvote it".