Microsoft AzureOverview
Ensure that unattached disks in a subscription are encrypted with a Customer Managed Key (CMK).
Rationale
Managed disks are encrypted by default with Platform-managed keys. Using Customer-managed keys may provide an additional level of security or meet an organization's regulatory requirements. Encrypting managed disks ensures that its entire content is fully unrecoverable without a key and thus protects the volume from unwarranted reads. Even if the disk is not attached to any of the VMs, there is always a risk where a compromised user account with administrative access to VM service can mount/attach these data disks which may lead to sensitive information disclosure and tampering.
Impact
Having a key vault set up to utilize this is needed. Encryption is available only on Standard tier VMs. This might increase costs.
Utilizing and maintaining Customer-managed keys will require additional work to create, protect, and rotate keys.
Default Value
By default, managed disks are encrypted with a Platform-managed key.
References
- https://docs.microsoft.com/en-us/azure/security/fundamentals/azure-disk-encryption-vms-vmss
- https://docs.microsoft.com/en-us/azure/security-center/security-center-disk-encryption?toc=%2fazure%2fsecurity%2ftoc.json
- https://docs.microsoft.com/en-us/rest/api/compute/disks/delete
- https://docs.microsoft.com/en-us/cli/azure/disk?view=azure-cli-latest#az-disk-delete
- https://docs.microsoft.com/en-us/rest/api/compute/disks/update#encryptionsettings
- https://docs.microsoft.com/en-us/cli/azure/disk?view=azure-cli-latest#az-disk-update
- https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-data-protection#dp-5-encrypt-sensitive-data-at-rest
Remediation guidance
From Azure Console
- Go to
Disks - Click on
Add filter - For
Filter nameselectDisk state, forOperatorselectEquals, and forValueonly selectUnattached - Select
Apply - For every disk, go to
EncryptionunderSettings - For
Key management, select the customer-managed key you want to use - Select
Save
Multiple Remediation Paths
Azure
SERVICE-WIDE (RECOMMENDED when many resources are affected): Assign Azure Policy initiatives at management group/subscription scope and trigger remediation tasks.
az policy assignment create --name <assignment-name> --scope /subscriptions/<subscription-id> --policy-set-definition <initiative-id>
az policy remediation create --name <remediation-name> --policy-assignment <assignment-id>
ASSET-LEVEL: Apply the resource-specific remediation steps above to the listed non-compliant resources.
PREVENTIVE: Embed Azure Policy checks into landing zones and IaC workflows to block or auto-remediate drift.
References for Service-Wide Patterns
- Azure Policy overview: https://learn.microsoft.com/en-us/azure/governance/policy/overview
- Azure Policy remediation: https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources
- Azure Policy initiative structure: https://learn.microsoft.com/en-us/azure/governance/policy/concepts/initiative-definition-structure
Operational Rollout Workflow
Use this sequence to reduce risk and avoid repeated drift.
1. Contain at Service-Wide Scope First (Recommended)
- Azure: assign policy initiatives at management group/subscription scope and run remediation tasks.
az policy assignment create --name <assignment-name> --scope /subscriptions/<subscription-id> --policy-set-definition <initiative-id>
az policy remediation create --name <remediation-name> --policy-assignment <assignment-id>
2. Remediate Existing Affected Assets
- Execute the control-specific Console/CLI steps documented above for each flagged resource.
- Prioritize internet-exposed and production assets first.
3. Validate and Prevent Recurrence
- Re-scan after each remediation batch.
- Track exceptions with owner and expiry date.
- Add preventive checks in IaC/CI pipelines.
Query logic
These are the stored checks tied to this control.
'Unattached disks' are encrypted with CMK
Connectors
Covered asset types
Expected check: eq []
{disks(where:{diskState_MATCHES:"(?i)unattached",encryptionKey:null}){...AssetFragment}}
