Verify guest decryption before rebuilding an ADE-encrypted VM

Source facts

Microsoft explains that the portal can show SSE plus platform-managed keys immediately after the ADE disable command while decryption inside the guest is still running. Its migration procedure requires new disks and VMs because direct conversion to encryption at host is unsupported. Linux OS disks encrypted with ADE cannot be decrypted in place; that case requires a new VM and OS disk. Microsoft Learn

Applicability

This check belongs in a planned migration from Azure Disk Encryption to encryption at host, with the operating system and encrypted disk scope identified first.

DSE recommendation

DSE recommends a separate guest-decryption checkpoint before disk-copy work begins. Record the operating system, disks involved, recovery arrangements, and migration branch. For a supported decryption path, ask the operator to capture the guest-level status after processing completes. Route an encrypted Linux OS disk to the documented replacement path instead of treating a changed portal label as authorization to continue the same procedure.

Verification

Review the guest evidence against the identified disks and the selected migration branch. Confirm that the replacement plan includes required configuration and application checks. Keep any uncertain decryption state unresolved, and require a fresh check before copying or replacing resources during the approved maintenance window.

Official references

• Microsoft: Migrate from Azure Disk Encryption to encryption at host – Azure Virtual Machines | Microsoft Learn