# Verify guest decryption before rebuilding an ADE-encrypted VM

> DSE recommends a separate guest-decryption checkpoint before disk-copy work begins.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-021-verify-guest-decryption-before-rebuilding-an-ade-encrypted-vm/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:39+00:00
- Modified: 2026-09-17T16:35:03+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: IT
- Reading time: 1 minutes

## What you need to know

DSE recommends a separate guest-decryption checkpoint before disk-copy work begins.

## Potentially affected

This check belongs in a planned migration from Azure Disk Encryption to encryption at host, with the operating system and encrypted disk scope identified first.

## DSE recommendation

DSE recommends a separate guest-decryption checkpoint before disk-copy work begins.

## Article

## Source facts

Microsoft explains that the portal can show SSE plus platform-managed keys immediately after the ADE disable command while decryption inside the guest is still running. Its migration procedure requires new disks and VMs because direct conversion to encryption at host is unsupported. Linux OS disks encrypted with ADE cannot be decrypted in place; that case requires a new VM and OS disk. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-migrate)

## Applicability

This check belongs in a planned migration from Azure Disk Encryption to encryption at host, with the operating system and encrypted disk scope identified first.

## DSE recommendation

DSE recommends a separate guest-decryption checkpoint before disk-copy work begins. Record the operating system, disks involved, recovery arrangements, and migration branch. For a supported decryption path, ask the operator to capture the guest-level status after processing completes. Route an encrypted Linux OS disk to the documented replacement path instead of treating a changed portal label as authorization to continue the same procedure.

## Verification

Review the guest evidence against the identified disks and the selected migration branch. Confirm that the replacement plan includes required configuration and application checks. Keep any uncertain decryption state unresolved, and require a fresh check before copying or replacing resources during the approved maintenance window.

## Official references

- [Microsoft: Migrate from Azure Disk Encryption to encryption at host – Azure Virtual Machines | Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-migrate)

## Primary reference

- Name: Migrate from Azure Disk Encryption to encryption at host - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-migrate
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Verify guest decryption before rebuilding an ADE-encrypted VM,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-021-verify-guest-decryption-before-rebuilding-an-ade-encrypted-vm/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.