Azure-cli: Contains disable an decrypt?

[StefanSchoof]

The documentation is not clear what disable means for the data. Does a disable includes a decrypt or is the data no longer accessibly after a disable?

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 4762f857-8a1e-f1bb-7843-3d8fefe28f8e
• Version Independent ID: 91ce956c-c915-5053-56b0-a489fb2f7b00
• Content: az vm encryption
• Content Source: src/command_modules/azure-cli-vm/azure/cli/command_modules/vm/_help.py
• Service: virtual-machines
• GitHub Login: @rloutlaw
• Microsoft Alias: routlaw

[ejarvi]

Decrypting a Linux system that has an encrypted OS disk is not currently possible via this command.

[StefanSchoof]

But for Windows it decrypts the disks?

[adewaleo]

similar to #8671

[ejarvi]

See also: https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-faq#can-i-encrypt-both-boot-and-data-volumes-with-azure-disk-encryption

[ejarvi]

@StefanSchoof Yes that is correct. For more background, the Windows solution calls into Bitlocker, which has a native capability to both encrypt and decrypt the underlying disk without terminating running processes or affecting the availability of the system. The Linux solution calls into dm-crypt via cryptsetup in a way that requires processes to be terminated and for the disk to be unmounted prior to an encrypt or decrypt operation. For the enable scenario, this operation is possible when the VM configuration meets the prerequisites. On disable however, which typically occurs after more modifications have been made to the system and more applications are running, the solution does not currently have a reliable way to go in the reverse direction for the OS volume.

[adewaleo]

@StefanSchoof , yes disabling encryption is indeed decrypting the disk. Please see ADE docs - decryption workflow for more info.

[adewaleo]

I have updated VM encryption's documentation (see pr #8691). Closing this.