{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-183-identify-the-encryption-layer-before-resizing-an-ade-protected-linux-logical-volume/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-183-identify-the-encryption-layer-before-resizing-an-ade-protected-linux-logical-volume/", "slug": "dse-20260917-183-identify-the-encryption-layer-before-resizing-an-ade-protected-linux-logical-volume", "url": "https://update.dsesecurity.com/updates/dse-20260917-183-identify-the-encryption-layer-before-resizing-an-ade-protected-linux-logical-volume/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-183-identify-the-encryption-layer-before-resizing-an-ade-protected-linux-logical-volume.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-183-identify-the-encryption-layer-before-resizing-an-ade-protected-linux-logical-volume/" }, "title": "Identify the encryption layer before resizing an ADE-protected Linux logical volume", "summary": "DSE recommends drawing the current disk, encryption, physical-volume, volume-group, logical-volume, and filesystem relationships before selecting a procedure.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:31:57+00:00", "modified_at": "2026-09-17T16:46:29+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 205, "potentially_affected": "Use this check for an existing Linux data-disk configuration protected by Azure Disk Encryption when an experienced LVM operator is preparing a resize.", "dse_recommendation": "DSE recommends drawing the current disk, encryption, physical-volume, volume-group, logical-volume, and filesystem relationships before selecting a procedure.", "primary_source": { "name": "How to resize disks encrypted using Azure Disk Encryption - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/linux/how-to-resize-encrypted-lvm", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft’s resize procedure covers encrypted data disks and explicitly excludes OS disk resizing. In traditional LVM encryption, the logical volumes are encrypted; LVM-on-crypt places encryption at the whole-disk layer. The guide advises against combining those two encryption layouts on one VM. Microsoft Learn

\n

Applicability

\n

Use this check for an existing Linux data-disk configuration protected by Azure Disk Encryption when an experienced LVM operator is preparing a resize.

\n

DSE recommendation

\n

DSE recommends drawing the current disk, encryption, physical-volume, volume-group, logical-volume, and filesystem relationships before selecting a procedure. Confirm that the target is a data volume and record the free space available in the relevant group. Have the workload owner approve the capacity goal and recovery arrangements. Treat the source’s separate layout branches as distinct procedures and avoid copying device names or sample sizes into a production command.

\n

Verification

\n

Inspect the observed block-device and LVM layout against the plan before any change. After the authorized resize, check both logical-volume size and filesystem capacity, then run the agreed workload-access test. Retain the before-and-after mapping and resolve any encryption-layer or mount discrepancy before accepting the new capacity.

\n

Official references

\n", "content_text": "Source facts\nMicrosoft’s resize procedure covers encrypted data disks and explicitly excludes OS disk resizing. In traditional LVM encryption, the logical volumes are encrypted; LVM-on-crypt places encryption at the whole-disk layer. The guide advises against combining those two encryption layouts on one VM. Microsoft Learn\nApplicability\nUse this check for an existing Linux data-disk configuration protected by Azure Disk Encryption when an experienced LVM operator is preparing a resize.\nDSE recommendation\nDSE recommends drawing the current disk, encryption, physical-volume, volume-group, logical-volume, and filesystem relationships before selecting a procedure. Confirm that the target is a data volume and record the free space available in the relevant group. Have the workload owner approve the capacity goal and recovery arrangements. Treat the source’s separate layout branches as distinct procedures and avoid copying device names or sample sizes into a production command.\nVerification\nInspect the observed block-device and LVM layout against the plan before any change. After the authorized resize, check both logical-volume size and filesystem capacity, then run the agreed workload-access test. Retain the before-and-after mapping and resolve any encryption-layer or mount discrepancy before accepting the new capacity.\nOfficial references\n\nMicrosoft: How to resize disks encrypted using Azure Disk Encryption – Azure Virtual Machines | Microsoft Learn", "content_markdown": "## Source facts\n\nMicrosoft’s resize procedure covers encrypted data disks and explicitly excludes OS disk resizing. In traditional LVM encryption, the logical volumes are encrypted; LVM-on-crypt places encryption at the whole-disk layer. The guide advises against combining those two encryption layouts on one VM. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/linux/how-to-resize-encrypted-lvm)\n\n## Applicability\n\nUse this check for an existing Linux data-disk configuration protected by Azure Disk Encryption when an experienced LVM operator is preparing a resize.\n\n## DSE recommendation\n\nDSE recommends drawing the current disk, encryption, physical-volume, volume-group, logical-volume, and filesystem relationships before selecting a procedure. Confirm that the target is a data volume and record the free space available in the relevant group. Have the workload owner approve the capacity goal and recovery arrangements. Treat the source’s separate layout branches as distinct procedures and avoid copying device names or sample sizes into a production command.\n\n## Verification\n\nInspect the observed block-device and LVM layout against the plan before any change. After the authorized resize, check both logical-volume size and filesystem capacity, then run the agreed workload-access test. Retain the before-and-after mapping and resolve any encryption-layer or mount discrepancy before accepting the new capacity.\n\n## Official references\n\n- [Microsoft: How to resize disks encrypted using Azure Disk Encryption – Azure Virtual Machines | Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/linux/how-to-resize-encrypted-lvm)" }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-183-identify-the-encryption-layer-before-resizing-an-ade-protected-linux-logical-volume/", "url": "https://update.dsesecurity.com/updates/dse-20260917-183-identify-the-encryption-layer-before-resizing-an-ade-protected-linux-logical-volume/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-183-identify-the-encryption-layer-before-resizing-an-ade-protected-linux-logical-volume/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Identify the encryption layer before resizing an ADE-protected Linux logical volume", "item": "https://update.dsesecurity.com/updates/dse-20260917-183-identify-the-encryption-layer-before-resizing-an-ade-protected-linux-logical-volume/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-183-identify-the-encryption-layer-before-resizing-an-ade-protected-linux-logical-volume/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-183-identify-the-encryption-layer-before-resizing-an-ade-protected-linux-logical-volume/", "url": "https://update.dsesecurity.com/updates/dse-20260917-183-identify-the-encryption-layer-before-resizing-an-ade-protected-linux-logical-volume/", "headline": "Identify the encryption layer before resizing an ADE-protected Linux logical volume", "description": "DSE recommends drawing the current disk, encryption, physical-volume, volume-group, logical-volume, and filesystem relationships before selecting a…", "abstract": "DSE recommends drawing the current disk, encryption, physical-volume, volume-group, logical-volume, and filesystem relationships before selecting a procedure.", "articleBody": "Source facts\nMicrosoft’s resize procedure covers encrypted data disks and explicitly excludes OS disk resizing. In traditional LVM encryption, the logical volumes are encrypted; LVM-on-crypt places encryption at the whole-disk layer. The guide advises against combining those two encryption layouts on one VM. Microsoft Learn\nApplicability\nUse this check for an existing Linux data-disk configuration protected by Azure Disk Encryption when an experienced LVM operator is preparing a resize.\nDSE recommendation\nDSE recommends drawing the current disk, encryption, physical-volume, volume-group, logical-volume, and filesystem relationships before selecting a procedure. Confirm that the target is a data volume and record the free space available in the relevant group. Have the workload owner approve the capacity goal and recovery arrangements. Treat the source’s separate layout branches as distinct procedures and avoid copying device names or sample sizes into a production command.\nVerification\nInspect the observed block-device and LVM layout against the plan before any change. After the authorized resize, check both logical-volume size and filesystem capacity, then run the agreed workload-access test. Retain the before-and-after mapping and resolve any encryption-layer or mount discrepancy before accepting the new capacity.\nOfficial references\n\nMicrosoft: How to resize disks encrypted using Azure Disk Encryption – Azure Virtual Machines | Microsoft Learn", "datePublished": "2026-09-17T16:31:57+00:00", "dateModified": "2026-09-17T16:46:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-183-identify-the-encryption-layer-before-resizing-an-ade-protected-linux-logical-volume/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-183-identify-the-encryption-layer-before-resizing-an-ade-protected-linux-logical-volume/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Identify the encryption layer before resizing an ADE-protected Linux logical volume" }, "articleSection": [ "IT" ], "keywords": [ "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 205, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "How to resize disks encrypted using Azure Disk Encryption - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/linux/how-to-resize-encrypted-lvm" } } ] } }