Skip to main content
Storage Service Encryption (SSE) and Azure Disk Encryption (ADE) explained — what they protect, how they work, and how to enable them in the Azure portal.

​
Storage Service Encryption (SSE)

Storage Service Encryption — often called service-side encryption — encrypts data as it is written to Azure Storage so your data remains protected at rest. What SSE provides
  • Protection: Data at rest is encrypted automatically for Azure Storage services (Blob, File, Queue, and Table). Data is decrypted transparently when read.
  • Compliance: SSE helps you meet regulatory and security requirements without needing to implement your own encryption scheme for stored data.
  • Strong cipher: SSE uses AES-256 (256-bit AES) for encryption.
  • Managed operations: By default, the storage service handles encryption, decryption, and key management.
  • Default state: SSE is enabled by default for all storage accounts and cannot be turned off.
Customer-managed keys (CMK)
  • Use CMK when you require control over key lifecycle, rotation, or auditing.
    • Configure the storage account to use a key stored in Azure Key Vault.
    • Grant the storage account access to Key Vault using a managed identity and a Key Vault access policy or RBAC.
    • CMK support varies by storage service; blobs and files are commonly supported first — confirm service coverage for your scenario.
By default, storage accounts use Microsoft-managed keys and SSE is always on. Choose customer-managed keys only when you need full control over key lifecycle and rotation; verify service-specific CMK support and Key Vault access requirements.
In the Azure portal you can inspect and change the encryption configuration for a storage account.
A screenshot of the Microsoft Azure portal showing the Encryption settings for a storage account (demoaz0753553), with options for encryption type, key selection (Microsoft‑managed or customer‑managed), and identity type. The left navigation lists storage features (Containers, File shares, Queues, etc.) and Save/Discard buttons appear at the bottom.
Note: Enabling customer-managed keys in the portal can be limited to certain services (for example, blobs and files). Review the storage account and service documentation to confirm CMK coverage for your use case.

​
Azure Disk Encryption (ADE)

Azure Disk Encryption protects the contents of virtual machine disks (OS and data disks) by applying encryption at the VM level. ADE prevents someone from mounting a VHD from storage to another VM and reading its contents without the appropriate keys. How ADE works
  • ADE encrypts OS and data disks for Windows and Linux VMs.
  • It uses platform tools: BitLocker for Windows and DM-Crypt for Linux to perform encryption inside the VM.
  • Encryption keys are stored in Azure Key Vault.
  • Only identities with Key Vault access to the encryption keys can decrypt and access disk contents.
  • Azure Backup supports ADE-encrypted VMs; backups remain encrypted and releases require access to the same Key Vault keys.
  • ADE uses AES-256 encryption for disk data.
Operational considerations
  • Reboot requirement: Enabling or updating ADE on a VM requires a reboot.
  • Performance: A small performance overhead exists due to encryption/decryption. For CPU-heavy workloads, consider encrypting data disks only — but evaluate security implications of leaving the OS disk unencrypted.
  • Key and permission management: ADE requires keys stored in Azure Key Vault and appropriate permissions. If you also use CMK for the storage account holding VHDs, validate compatibility and configuration requirements in Azure documentation.
Before enabling ADE, verify Key Vault access and confirm compatibility with any customer-managed key configurations for storage accounts. Some scenarios may require platform-managed keys or adjusted Key Vault permissions.

​
Enabling ADE in the Azure portal

To enable Azure Disk Encryption for a VM:
  1. Open the VM in the Azure portal.
  2. Navigate to Disks → Additional settings (or Disk settings).
  3. Choose whether to encrypt the OS disk, data disks, or both.
  4. Save changes — the VM will require a reboot to apply encryption settings.
The Disk settings area may also show Encryption at Host options. Enabling Encryption at Host typically requires the VM to be stopped before the setting can be applied.
Screenshot of the Microsoft Azure portal showing the "Disk settings" page for a virtual machine, with options for Ultra disk compatibility, host encryption, and a dropdown to choose which disks to encrypt. A cursor is hovering over the dropdown and there are "Save" and "Cancel" buttons at the bottom.

​
Encryption at host

Azure offers Encryption at Host, which encrypts VM disks on the physical host while the VM is running. This is separate from SSE and ADE:
  • Scope: Encryption at Host protects disks on the host layer (transparent to the VM).
  • Key management: Managed by Azure (platform-managed).
  • Use cases: Adds a host-level protection boundary in multi-tenant hardware scenarios.
For a deeper comparison and guidance on when to use each option, consult Azure documentation.

​
Quick comparison

That covers Storage Service Encryption (SSE), Azure Disk Encryption (ADE), and how they differ from Encryption at Host.

Watch Video