Issue with Defender Recommendations - Linux virtual machines should enable Azure Disk Encryption or EncryptionAtHost.

Hello Kuldeep Singh(OT),

Thanks for your question.

I will recommend the following:

Verify that Encryption at Host is indeed enabled for all your VMs. You can do this through the Azure portal or Azure CLI. To do this with CLI, see:

az vm encryption show --name MyVirtualMachine --resource-group MyResourceGroup

If confirmed it is enabled, then Give it some time (up to 24 hours) for Azure to refresh its recommendation status.

See: https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-overview

Regards,

You can mark it 'Accept Answer' if this helped you

Hello, @Kuldeep Singh(OT) !

Why am I getting a Defender recommendation for EncryptionAtHost when it is already enabled?

This appears to be unintended behavior and we would like to look at your resources to further investigate the issue.

• Email body: Your Subscription ID
• Email body: A link to this thread so we can validate and expedite the request

If you don't receive a response within 24 hours, please reply to the thread so we can investigate.

Issue summary:

• Encryption at Host has been enabled for all VMs.
• You have verified that Encryption at Host is enabled via az vm encruption show on your Linux VMs.
• Defender shows a healthy state for Encryption at Host on your Linux VMs.
• Defender shows an unhealthy state for Encryption at Host or enable Azure Disk Encryption for your Linux VMs.

I hope this has been helpful! Your feedback is important so please take a moment to accept answers.

If you still have questions, please let us know what is needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!

Closing comment on Issue with Defender Recommendations - Linux virtual machines should enable Azure Disk Encryption or EncryptionAtHost.

This recommendation will not resolved until you uses Guest Configuration extenstion and manage identity as it requires two pre-requisites which are System identity and AzurePolicy extension to be present on Azure vm.

Thanks

I too have this issue (in fact, I am seeing lots of similar issues with Advisor telling me to fix things I fixed over a week ago). The VMs have the Guest Configuration Extension installed, they have a Managed Identity, and I have enabled Encryption At Host, yet over a week after doing this they still show as unhealthy in Advisor.