{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-021-verify-guest-decryption-before-rebuilding-an-ade-encrypted-vm/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260917-021-verify-guest-decryption-before-rebuilding-an-ade-encrypted-vm/",
        "slug": "dse-20260917-021-verify-guest-decryption-before-rebuilding-an-ade-encrypted-vm",
        "url": "https://update.dsesecurity.com/updates/dse-20260917-021-verify-guest-decryption-before-rebuilding-an-ade-encrypted-vm/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260917-021-verify-guest-decryption-before-rebuilding-an-ade-encrypted-vm.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-021-verify-guest-decryption-before-rebuilding-an-ade-encrypted-vm/"
        },
        "title": "Verify guest decryption before rebuilding an ADE-encrypted VM",
        "summary": "DSE recommends a separate guest-decryption checkpoint before disk-copy work begins.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "managed-it",
            "label": "Managed IT operations",
            "alt": "A controlled technology lifecycle progressing from assessment to approved production.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-17T16:34:39+00:00",
        "modified_at": "2026-09-17T16:35:03+00:00",
        "reviewed_on": "2026-09-17",
        "reading_minutes": 1,
        "word_count": 220,
        "potentially_affected": "This check belongs in a planned migration from Azure Disk Encryption to encryption at host, with the operating system and encrypted disk scope identified first.",
        "dse_recommendation": "DSE recommends a separate guest-decryption checkpoint before disk-copy work begins.",
        "primary_source": {
            "name": "Migrate from Azure Disk Encryption to encryption at host - Azure Virtual Machines | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-migrate",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft explains that the portal can show SSE plus platform-managed keys immediately after the ADE disable command while decryption inside the guest is still running. Its migration procedure requires new disks and VMs because direct conversion to encryption at host is unsupported. Linux OS disks encrypted with ADE cannot be decrypted in place; that case requires a new VM and OS disk. <a href=\"https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-migrate\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a></p>\n<h2>Applicability</h2>\n<p>This check belongs in a planned migration from Azure Disk Encryption to encryption at host, with the operating system and encrypted disk scope identified first.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends a separate guest-decryption checkpoint before disk-copy work begins. Record the operating system, disks involved, recovery arrangements, and migration branch. For a supported decryption path, ask the operator to capture the guest-level status after processing completes. Route an encrypted Linux OS disk to the documented replacement path instead of treating a changed portal label as authorization to continue the same procedure.</p>\n<h2>Verification</h2>\n<p>Review the guest evidence against the identified disks and the selected migration branch. Confirm that the replacement plan includes required configuration and application checks. Keep any uncertain decryption state unresolved, and require a fresh check before copying or replacing resources during the approved maintenance window.</p>\n<h2>Official references</h2>\n<ul>\n<li><a href=\"https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-migrate\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft: Migrate from Azure Disk Encryption to encryption at host &#8211; Azure Virtual Machines | Microsoft Learn</a></li>\n</ul>",
        "content_text": "Source facts\nMicrosoft explains that the portal can show SSE plus platform-managed keys immediately after the ADE disable command while decryption inside the guest is still running. Its migration procedure requires new disks and VMs because direct conversion to encryption at host is unsupported. Linux OS disks encrypted with ADE cannot be decrypted in place; that case requires a new VM and OS disk. Microsoft Learn\nApplicability\nThis check belongs in a planned migration from Azure Disk Encryption to encryption at host, with the operating system and encrypted disk scope identified first.\nDSE recommendation\nDSE recommends a separate guest-decryption checkpoint before disk-copy work begins. Record the operating system, disks involved, recovery arrangements, and migration branch. For a supported decryption path, ask the operator to capture the guest-level status after processing completes. Route an encrypted Linux OS disk to the documented replacement path instead of treating a changed portal label as authorization to continue the same procedure.\nVerification\nReview the guest evidence against the identified disks and the selected migration branch. Confirm that the replacement plan includes required configuration and application checks. Keep any uncertain decryption state unresolved, and require a fresh check before copying or replacing resources during the approved maintenance window.\nOfficial references\n\nMicrosoft: Migrate from Azure Disk Encryption to encryption at host – Azure Virtual Machines | Microsoft Learn",
        "content_markdown": "## Source facts\n\nMicrosoft explains that the portal can show SSE plus platform-managed keys immediately after the ADE disable command while decryption inside the guest is still running. Its migration procedure requires new disks and VMs because direct conversion to encryption at host is unsupported. Linux OS disks encrypted with ADE cannot be decrypted in place; that case requires a new VM and OS disk. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-migrate)\n\n## Applicability\n\nThis check belongs in a planned migration from Azure Disk Encryption to encryption at host, with the operating system and encrypted disk scope identified first.\n\n## DSE recommendation\n\nDSE recommends a separate guest-decryption checkpoint before disk-copy work begins. Record the operating system, disks involved, recovery arrangements, and migration branch. For a supported decryption path, ask the operator to capture the guest-level status after processing completes. Route an encrypted Linux OS disk to the documented replacement path instead of treating a changed portal label as authorization to continue the same procedure.\n\n## Verification\n\nReview the guest evidence against the identified disks and the selected migration branch. Confirm that the replacement plan includes required configuration and application checks. Keep any uncertain decryption state unresolved, and require a fresh check before copying or replacing resources during the approved maintenance window.\n\n## Official references\n\n- [Microsoft: Migrate from Azure Disk Encryption to encryption at host – Azure Virtual Machines | Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-migrate)"
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-021-verify-guest-decryption-before-rebuilding-an-ade-encrypted-vm/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-021-verify-guest-decryption-before-rebuilding-an-ade-encrypted-vm/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-17"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-021-verify-guest-decryption-before-rebuilding-an-ade-encrypted-vm/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Verify guest decryption before rebuilding an ADE-encrypted VM",
                        "item": "https://update.dsesecurity.com/updates/dse-20260917-021-verify-guest-decryption-before-rebuilding-an-ade-encrypted-vm/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-021-verify-guest-decryption-before-rebuilding-an-ade-encrypted-vm/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260917-021-verify-guest-decryption-before-rebuilding-an-ade-encrypted-vm/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-021-verify-guest-decryption-before-rebuilding-an-ade-encrypted-vm/",
                "headline": "Verify guest decryption before rebuilding an ADE-encrypted VM",
                "description": "DSE recommends a separate guest-decryption checkpoint before disk-copy work begins.",
                "abstract": "DSE recommends a separate guest-decryption checkpoint before disk-copy work begins.",
                "articleBody": "Source facts\nMicrosoft explains that the portal can show SSE plus platform-managed keys immediately after the ADE disable command while decryption inside the guest is still running. Its migration procedure requires new disks and VMs because direct conversion to encryption at host is unsupported. Linux OS disks encrypted with ADE cannot be decrypted in place; that case requires a new VM and OS disk. Microsoft Learn\nApplicability\nThis check belongs in a planned migration from Azure Disk Encryption to encryption at host, with the operating system and encrypted disk scope identified first.\nDSE recommendation\nDSE recommends a separate guest-decryption checkpoint before disk-copy work begins. Record the operating system, disks involved, recovery arrangements, and migration branch. For a supported decryption path, ask the operator to capture the guest-level status after processing completes. Route an encrypted Linux OS disk to the documented replacement path instead of treating a changed portal label as authorization to continue the same procedure.\nVerification\nReview the guest evidence against the identified disks and the selected migration branch. Confirm that the replacement plan includes required configuration and application checks. Keep any uncertain decryption state unresolved, and require a fresh check before copying or replacing resources during the approved maintenance window.\nOfficial references\n\nMicrosoft: Migrate from Azure Disk Encryption to encryption at host – Azure Virtual Machines | Microsoft Learn",
                "datePublished": "2026-09-17T16:34:39+00:00",
                "dateModified": "2026-09-17T16:35:03+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-021-verify-guest-decryption-before-rebuilding-an-ade-encrypted-vm/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-021-verify-guest-decryption-before-rebuilding-an-ade-encrypted-vm/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Verify guest decryption before rebuilding an ADE-encrypted VM"
                },
                "articleSection": [
                    "IT"
                ],
                "keywords": [
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 220,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Migrate from Azure Disk Encryption to encryption at host - Azure Virtual Machines | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-migrate"
                }
            }
        ]
    }
}