{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-051-choose-the-disk-encryption-set-s-type-before-enabling-double-encryption/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-051-choose-the-disk-encryption-set-s-type-before-enabling-double-encryption/", "slug": "dse-20260909-051-choose-the-disk-encryption-set-s-type-before-enabling-double-encryption", "url": "https://update.dsesecurity.com/updates/dse-20260909-051-choose-the-disk-encryption-set-s-type-before-enabling-double-encryption/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-051-choose-the-disk-encryption-set-s-type-before-enabling-double-encryption.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-051-choose-the-disk-encryption-set-s-type-before-enabling-double-encryption/" }, "title": "Choose the disk encryption set's type before enabling double encryption", "summary": "Can an existing disk encryption set be repurposed for a different encryption type?", "format": { "slug": "checklist", "name": "Checklist" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:31:05+00:00", "modified_at": "2026-09-10T00:35:07+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 260, "potentially_affected": "Operators planning double encryption at rest for supported Azure managed disks.", "dse_recommendation": "Treat the disk encryption set's encryption type as a creation-time design choice and plan a new set when the type differs.", "primary_source": { "name": "Enable double encryption at rest for managed disks - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-double-encryption-at-rest-portal", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

A disk encryption set’s encryption type cannot be changed after creation; Microsoft requires a new set for another type. The double-encryption workflow selects platform-managed plus customer-managed keys. Ultra Disk and Premium SSD v2 are excluded. The Key Vault used for managed-disk encryption must have soft delete and purge protection enabled. Microsoft Learn.

\n

Applicability

\n

Evaluate the exact managed disk, its storage type, and the existing encryption-set resource before choosing a deployment path. Identify the approved customer key and key-vault owner. Do not describe a disk encryption set’s fixed type as a prohibition on all future disk-encryption changes; the distinction is the resource that must be newly created.

\n

DSE recommendation

\n

Treat the disk encryption set’s encryption type as a creation-time design choice and plan a new set when the type differs. Make the requested type explicit in the deployment review instead of relying on an existing set’s name. Ask the security owner to confirm the key and vault protections before associating production disks. Keep the replacement set and the currently used set separately identified throughout the change.

\n

Verification

\n

Inspect the new set’s encryption type, key reference, and vault access before testing a disk association. Compare the disk’s resulting encryption configuration with the approved design and perform the agreed application-access test. Retain the original resource mapping until the workload owner accepts the change. Record failed key access separately from an unsupported disk type so a permission adjustment is not used to work around a capability restriction.

\n

Official references

\n

Microsoft Learn: Enable double encryption at rest for managed disks. Source reviewed September 9, 2026.

", "content_text": "Source facts\nA disk encryption set’s encryption type cannot be changed after creation; Microsoft requires a new set for another type. The double-encryption workflow selects platform-managed plus customer-managed keys. Ultra Disk and Premium SSD v2 are excluded. The Key Vault used for managed-disk encryption must have soft delete and purge protection enabled. Microsoft Learn.\nApplicability\nEvaluate the exact managed disk, its storage type, and the existing encryption-set resource before choosing a deployment path. Identify the approved customer key and key-vault owner. Do not describe a disk encryption set’s fixed type as a prohibition on all future disk-encryption changes; the distinction is the resource that must be newly created.\nDSE recommendation\nTreat the disk encryption set’s encryption type as a creation-time design choice and plan a new set when the type differs. Make the requested type explicit in the deployment review instead of relying on an existing set’s name. Ask the security owner to confirm the key and vault protections before associating production disks. Keep the replacement set and the currently used set separately identified throughout the change.\nVerification\nInspect the new set’s encryption type, key reference, and vault access before testing a disk association. Compare the disk’s resulting encryption configuration with the approved design and perform the agreed application-access test. Retain the original resource mapping until the workload owner accepts the change. Record failed key access separately from an unsupported disk type so a permission adjustment is not used to work around a capability restriction.\nOfficial references\nMicrosoft Learn: Enable double encryption at rest for managed disks. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nA disk encryption set’s encryption type cannot be changed after creation; Microsoft requires a new set for another type. The double-encryption workflow selects platform-managed plus customer-managed keys. Ultra Disk and Premium SSD v2 are excluded. The Key Vault used for managed-disk encryption must have soft delete and purge protection enabled. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-double-encryption-at-rest-portal).\n\n## Applicability\n\nEvaluate the exact managed disk, its storage type, and the existing encryption-set resource before choosing a deployment path. Identify the approved customer key and key-vault owner. Do not describe a disk encryption set’s fixed type as a prohibition on all future disk-encryption changes; the distinction is the resource that must be newly created.\n\n## DSE recommendation\n\nTreat the disk encryption set’s encryption type as a creation-time design choice and plan a new set when the type differs. Make the requested type explicit in the deployment review instead of relying on an existing set’s name. Ask the security owner to confirm the key and vault protections before associating production disks. Keep the replacement set and the currently used set separately identified throughout the change.\n\n## Verification\n\nInspect the new set’s encryption type, key reference, and vault access before testing a disk association. Compare the disk’s resulting encryption configuration with the approved design and perform the agreed application-access test. Retain the original resource mapping until the workload owner accepts the change. Record failed key access separately from an unsupported disk type so a permission adjustment is not used to work around a capability restriction.\n\n## Official references\n\n[Microsoft Learn: Enable double encryption at rest for managed disks](https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-double-encryption-at-rest-portal). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-051-choose-the-disk-encryption-set-s-type-before-enabling-double-encryption/", "url": "https://update.dsesecurity.com/updates/dse-20260909-051-choose-the-disk-encryption-set-s-type-before-enabling-double-encryption/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-051-choose-the-disk-encryption-set-s-type-before-enabling-double-encryption/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Choose the disk encryption set's type before enabling double encryption", "item": "https://update.dsesecurity.com/updates/dse-20260909-051-choose-the-disk-encryption-set-s-type-before-enabling-double-encryption/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-051-choose-the-disk-encryption-set-s-type-before-enabling-double-encryption/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-051-choose-the-disk-encryption-set-s-type-before-enabling-double-encryption/", "url": "https://update.dsesecurity.com/updates/dse-20260909-051-choose-the-disk-encryption-set-s-type-before-enabling-double-encryption/", "headline": "Choose the disk encryption set's type before enabling double encryption", "description": "Can an existing disk encryption set be repurposed for a different encryption type?", "abstract": "Can an existing disk encryption set be repurposed for a different encryption type?", "articleBody": "Source facts\nA disk encryption set’s encryption type cannot be changed after creation; Microsoft requires a new set for another type. The double-encryption workflow selects platform-managed plus customer-managed keys. Ultra Disk and Premium SSD v2 are excluded. The Key Vault used for managed-disk encryption must have soft delete and purge protection enabled. Microsoft Learn.\nApplicability\nEvaluate the exact managed disk, its storage type, and the existing encryption-set resource before choosing a deployment path. Identify the approved customer key and key-vault owner. Do not describe a disk encryption set’s fixed type as a prohibition on all future disk-encryption changes; the distinction is the resource that must be newly created.\nDSE recommendation\nTreat the disk encryption set’s encryption type as a creation-time design choice and plan a new set when the type differs. Make the requested type explicit in the deployment review instead of relying on an existing set’s name. Ask the security owner to confirm the key and vault protections before associating production disks. Keep the replacement set and the currently used set separately identified throughout the change.\nVerification\nInspect the new set’s encryption type, key reference, and vault access before testing a disk association. Compare the disk’s resulting encryption configuration with the approved design and perform the agreed application-access test. Retain the original resource mapping until the workload owner accepts the change. Record failed key access separately from an unsupported disk type so a permission adjustment is not used to work around a capability restriction.\nOfficial references\nMicrosoft Learn: Enable double encryption at rest for managed disks. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:31:05+00:00", "dateModified": "2026-09-10T00:35:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-051-choose-the-disk-encryption-set-s-type-before-enabling-double-encryption/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-051-choose-the-disk-encryption-set-s-type-before-enabling-double-encryption/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose the disk encryption set's type before enabling double encryption" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Checklist", "Information priority" ], "genre": "Checklist", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 260, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Enable double encryption at rest for managed disks - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/disks-enable-double-encryption-at-rest-portal" } } ] } }