Home / Azure

AzureTroubleshootingAdvanced

Sev1: encrypted Azure VM won't start — Azure Disk Encryption key or vault access lost

Start a VM protected by Azure Disk Encryption (ADE) that fails because its Key Vault, secret, key or access settings changed. Recover the vault objects, re-enable disk encryption access and plan the move to encryption at host.

Deepak Bhardwaj2 min read

Applies toAzure VMs with Azure Disk Encryption (BitLocker / DM-Crypt), Azure Key Vault, Azure CLI 2.50+

Symptoms

  • VM start fails with a Key Vault related error, for example the secret URL in the disk encryption settings is not accessible.
  • After a "Key Vault cleanup", network lockdown or subscription move, encrypted VMs fail to start or restore.
  • Boot diagnostics show a BitLocker recovery screen (Windows) or a passphrase prompt (Linux).

1. Where does the VM expect its key?

az vm encryption show -g rg-app -n vm-app01 -o json
az vm show -g rg-app -n vm-app01 --query "storageProfile.osDisk.encryptionSettings" -o json

Note the vault resource ID, the secret URL (BitLocker/DM-Crypt passphrase) and, if used, the key encryption key (KEK) URL.

2. Check the vault

az keyvault show --name kv-ade-prod --query "{ade:properties.enabledForDiskEncryption, deploy:properties.enabledForDeployment, public:properties.publicNetworkAccess, rbac:properties.enableRbacAuthorization}" -o json
az keyvault list-deleted --resource-type vault -o table
Finding Fix
Vault soft-deleted az keyvault recover --name kv-ade-prod
enabledForDiskEncryption false az keyvault update --name kv-ade-prod --enabled-for-disk-encryption true
Secret or KEK soft-deleted az keyvault secret recover / az keyvault key recover
KEK disabled az keyvault key set-attributes --vault-name kv-ade-prod --name kek-ade --enabled true
Public access disabled with no trusted-services exception Allow trusted Microsoft services on the vault firewall 
az keyvault update --name kv-ade-prod --bypass AzureServices

3. Start and verify

az vm start -g rg-app -n vm-app01
az vm encryption show -g rg-app -n vm-app01 --query "disks[].statuses[].displayStatus" -o tsv

4. If the key is purged

Without the secret (and KEK) the disk cannot be decrypted. Options:

  • Restore the VM from Azure Backup. Backups of ADE VMs include the key and secret, which can be restored to the vault (az backup restore restore-disks and the Key Vault restore flow).
  • Restore the secret from a key backup if one exists.
  • Windows: a BitLocker recovery password saved elsewhere can unlock the disk on a rescue VM.

5. Plan the exit from ADE

Microsoft has announced the retirement of Azure Disk Encryption in favour of encryption at host and server-side encryption with customer-managed keys. Neither depends on a secret living in a vault the VM must reach at boot, which removes this whole failure mode. Check the retirement date in current documentation and plan migrations.

az feature show --namespace Microsoft.Compute --name EncryptionAtHost
az vm update -g rg-app -n vm-app02 --set securityProfile.encryptionAtHost=true   # VM must be deallocated

Prevent it next time

  • Purge protection and a delete lock on ADE vaults.
  • Tag ADE vaults clearly; exclude them from cleanup automation.
  • Test restoring an ADE VM from backup at least once.

Related fixes