Azure-docs: Following the instructions for Encrypt a running VM results in error

[rsouthm]

When following the directions to encrypt a running VM, I am unexpectedly prompted to provide an AadClientID. Creating an Azure application isn't discussed in the directions. I'm not sure if there's a bug in the documentation or the product.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: d7c63605-95f5-0953-3cf6-1e9c50532c1d
• Version Independent ID: 8731daa8-2c15-78f7-adac-151401c13b6c
• Content: Enable Azure Disk Encryption for Windows IaaS VMs
• Content Source: articles/security/azure-security-disk-encryption-windows.md
• Service: security
• GitHub Login: @mestew
• Microsoft Alias: mstewart

[rsouthm]

The AzureRM version might be helpful. I ran _Get-Module AzureRM -ListAvailable | Select-Object -Property Name,Version,Path_ to determine the version.. The result is: AzureRM 6.13.1 C:Program FilesWindowsPowerShellModulesAzureRM6.13.1AzureRM.psd1

[ManojReddy-MSFT]

@rsouthm Thanks for reporting this. Can you help me with the exact PS command that you ran when you get prompted for AadClientID ? This will help me with my testing.

Also in scenarios where disk encryption was previously done using an Azure AD app, you will be prompted for AadClientID.

"If you have previously used Azure Disk Encryption with Azure AD app to encrypt this VM, you will have to continue use this option to encrypt your VM. You can’t use Azure Disk Encryption on this encrypted VM as this isn’t a supported scenario, meaning switching away from AAD application for this encrypted VM isn’t supported yet" This is documented in the prerequisites section.

[jakaruna-MSFT]

@rsouthm I reproduced the issue.
I had an older version of AzureRM module(5.7.0). In that version, it asked for AadClientID.
I upgraded to the latest version(6.13.1). I see that you have already upgraded.
I am using PowerShell ISE. I restarted it and ran Import-Module AzureRM again to load the latest version.
After that the PowerShell script didn't ask for the AadClientID.
There is another issue in GitHub(#14080) which speaks about the same issue.
We need to have a AzureRM module with version greater the 6.0.0 which is mentioned in prerequisite.
Try this out and let us know.

[rsouthm]

I re-ran the commands today and it’s still prompting me for the AadClientID. It appears I do have the required version.
The VM is domain joined to Microsoft corpnet. It is on an ARM Express Route.

This is the set of commands I ran.

1.

Verify it's at least version 6.0

Get-Module AzureRM -ListAvailable | Select-Object -Property Name,Version,Path

--Results:
Name Version Path
---- ------- ----
AzureRM 6.13.1 C:Program FilesWindowsPowerShellModulesAzureRM6.13.1AzureRM.psd1

2.
#Connect to Azure
Connect-AzureRmAccount
Get-AzureRmSubscription
Set-AzureRmContext -SubscriptionId "858a14c3-a906-49a8-91f0-798be8cc8cc0

--Results:
Connection was successful

3.

Run the commands

Enable encryption on existing or running VMs with Azure PowerShell

https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-window

$rgName = 'OneCube';
$vmName = 'WSDSQLOC3A';
$KeyVaultName = 'OneCube-WestUS2';
$KeyVault = Get-AzureRmKeyVault -VaultName $KeyVaultName -ResourceGroupName $rgname;
$diskEncryptionKeyVaultUrl = $KeyVault.VaultUri;
$KeyVaultResourceId = $KeyVault.ResourceId;

Set-AzureRmVMDiskEncryptionExtension -ResourceGroupName $rgname -VMName $vmName -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId;

In this command, the $rgName is the resource group of the Key Vault, $vmName is the name of the VM I’m attempting to Encrypt, $KeyVaultName is the name of the KeyVault.
The Key Vault does exist in the same location (datacenter) as the VM.

--Results:

cmdlet Set-AzureRmVMDiskEncryptionExtension at command pipeline position 1
Supply values for the following parameters:
(Type !? for Help.)
AadClientID:

From: jakaruna-MSFT [e-mail]
Sent: Thursday, December 20, 2018 10:59 PM
To: MicrosoftDocs/azure-docs [e-mail]
Cc: Rhonda South [e-mail]; Mention [e-mail]
Subject: Re: [MicrosoftDocs/azure-docs] Following the instructions for Encrypt a running VM results in error (#21111)

@rsouthmhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Frsouthm&data=02%7C01%7Crsouth%40microsoft.com%7C9bf735d066d04c41bee408d66711ba5e%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636809723168184944&sdata=qTxY793QyR%2FUJQEN04W0Id%2FjHZHz%2FzSPPTxhxK0SIo8%3D&reserved=0 I reproduced the issue.
I had an older version of AzureRM module(5.7.0). In that version, it asked for AadClientID.
I upgraded to the latest version(6.13.1). I see that you have already upgraded.
I am using PowerShell ISE. I restarted it and ran Import-Module AzureRM again to load the latest version.
After that the PowerShell script didn't ask for the AadClientID.
There is another issue in GitHub(#14080https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FMicrosoftDocs%2Fazure-docs%2Fissues%2F14080&data=02%7C01%7Crsouth%40microsoft.com%7C9bf735d066d04c41bee408d66711ba5e%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636809723168194953&sdata=EGYoWcP62o702hHm3EvY8wZD5mKqzJKzX7XwbpWCmlM%3D&reserved=0) which speaks about the same issue.
We need to have a AzureRM module with version greater the 6.0.0 which is mentioned in prerequisitehttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fsecurity%2Fazure-security-disk-encryption-prerequisites%23bkmk_PSH&data=02%7C01%7Crsouth%40microsoft.com%7C9bf735d066d04c41bee408d66711ba5e%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636809723168194953&sdata=sStukRyUub3NAaY5KzFoLN9yCRcLv%2F3YO%2FxivWocS44%3D&reserved=0.
Try this out and let us know.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FMicrosoftDocs%2Fazure-docs%2Fissues%2F21111%23issuecomment-449280970&data=02%7C01%7Crsouth%40microsoft.com%7C9bf735d066d04c41bee408d66711ba5e%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636809723168204962&sdata=JQl357Ue8MuB90ckFCYxqClP2ZdLTESWDN7pFeh4Y2E%3D&reserved=0, or mute the threadhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAr5wbwH4QQoIN0BJijJJCKloZSN2_DIQks5u7IabgaJpZM4Zc971&data=02%7C01%7Crsouth%40microsoft.com%7C9bf735d066d04c41bee408d66711ba5e%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636809723168204962&sdata=WiaoP1XrpBoOZ5AsU%2BSAep6TjMjTqUcmQ6q0Ddu8uOk%3D&reserved=0.

[mestew]

Hey @rsouthm, sounds like you're an Microsoft employee. I just don't see your full name in your GitHub profile. Look me up in the GAL and toss me an IM.

[rsouthm]

Hey Meghan, I'm not at work right now but rsouth @ microsoft.com. I'll be back in the office on Wed.

Sent from Outlook

---

From: Meghan Stewart [e-mail]
Sent: Friday, December 21, 2018 2:20:21 PM
To: MicrosoftDocs/azure-docs
Cc: Rhonda South; Mention
Subject: Re: [MicrosoftDocs/azure-docs] Following the instructions for Encrypt a running VM results in error (#21111)

Hey @rsouthmhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Frsouthm&data=02%7C01%7Crsouth%40microsoft.com%7C21ed03a0d0fd4c7376b208d667927fd3%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636810276245682755&sdata=tVVQVyGW%2FMDWF%2FI1t1OpZTuNHvpVwXEGYHs1vjTMeQM%3D&reserved=0, sounds like you're an Microsoft employee. I just don't see your full name in your GitHub profile. Look me up in the GAL and toss me an IM.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FMicrosoftDocs%2Fazure-docs%2Fissues%2F21111%23issuecomment-449512628&data=02%7C01%7Crsouth%40microsoft.com%7C21ed03a0d0fd4c7376b208d667927fd3%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636810276245682755&sdata=eqaitImMr9nrh%2FwStgE6SHi9wOC9wyDgUfW%2Bjec65U4%3D&reserved=0, or mute the threadhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAr5wb0y5SE6W9U_JQtT7FuEEl3sgtImFks5u7V6lgaJpZM4Zc971&data=02%7C01%7Crsouth%40microsoft.com%7C21ed03a0d0fd4c7376b208d667927fd3%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636810276245692763&sdata=%2FBCZQsbBgVDMGP5ULguiIm88FAGuu9pJDZAkwdr%2FezY%3D&reserved=0.

[mestew]

This item is being handled offline. Docs will be updated if needed after investigation. #please-close

[Karishma-Tiwari-MSFT]

@rsouthm Thanks for bringing this to our attention. We will now close this issue. If there are further questions regarding this matter, please reopen it and we will gladly continue the discussion.

[szellerK]

@Karishma-Tiwari-MSFT

This does not seem to be fixed in Azure CLI 2.0.54. I am following the instructions for enabling encryption on an existing VM through Azure CLI and receive the following error:

Please provide --aad-client-id

[Karishma-Tiwari-MSFT]

@mestew @rsouthm Can either of you please share the solution here as another customer is also facing the same issue.

[rsouthm]

Using Cloudshell (Azure Powershell) appears to be a valid work-around. I haven’t seen a Powershell (Desktop) fix yet.

From: Karishma Tiwari - MSFT [e-mail]
Sent: Monday, January 7, 2019 9:29 AM
To: MicrosoftDocs/azure-docs [e-mail]
Cc: Rhonda South [e-mail]; Mention [e-mail]
Subject: Re: [MicrosoftDocs/azure-docs] Following the instructions for Encrypt a running VM results in error (#21111)

@mestewhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fmestew&data=02%7C01%7Crsouth%40microsoft.com%7C1096dc0334804e428c4108d674c5a5c5%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636824789566766795&sdata=JChcFo5YUZ0zkMRgVdgoANys0IwXnfB2RTBtQEO7qik%3D&reserved=0 @rsouthmhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Frsouthm&data=02%7C01%7Crsouth%40microsoft.com%7C1096dc0334804e428c4108d674c5a5c5%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636824789566766795&sdata=LlgnZORGS27UONd1%2BkyztE35gMNC7Oekn03UAlJNAzw%3D&reserved=0 Can either of you please share the solution here as another customer is also facing the same issue.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHubhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FMicrosoftDocs%2Fazure-docs%2Fissues%2F21111%23issuecomment-452013901&data=02%7C01%7Crsouth%40microsoft.com%7C1096dc0334804e428c4108d674c5a5c5%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636824789566776803&sdata=3OjoC6J%2F2OWPIvmtb6NgZoDBfs%2FBM7syQQ4EacWfZHA%3D&reserved=0, or mute the threadhttps://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAr5wbxRgLfr3JCghCufgNB20ZYuyKGSBks5vA4PrgaJpZM4Zc971&data=02%7C01%7Crsouth%40microsoft.com%7C1096dc0334804e428c4108d674c5a5c5%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636824789566786812&sdata=vKcTlvvc%2FYOrxgSwzS4%2FDKmoibjzYZjs8C32wHIwtlo%3D&reserved=0.

[mestew]

@Karishma-Tiwari-MSFT & @szellerK Looks like CLI version 2.0.32 back in May 2018 was the version that should have made the aad client id optional. https://docs.microsoft.com/en-us/cli/azure/release-notes-azure-cli?view=azure-cli-latest#vm-17
I will update to the latest version, which you are running, and double check it. Thanks.