Set-AzVmssDiskEncryptionExtension
Enables disk encryption on a VM scale set.
Syntax
Default (Default)
Set-AzVmssDiskEncryptionExtension
[-ResourceGroupName] <String>
[-VMScaleSetName] <String>
[-DiskEncryptionKeyVaultUrl] <String>
[-DiskEncryptionKeyVaultId] <String>
[-EncryptionIdentity <String>]
[-KeyEncryptionKeyUrl <String>]
[-KeyEncryptionKeyVaultId <String>]
[-KeyEncryptionAlgorithm <String>]
[-VolumeType <String>]
[-ForceUpdate]
[-TypeHandlerVersion <String>]
[-ExtensionPublisherName <String>]
[-ExtensionName <String>]
[-ExtensionType <String>]
[-EncryptFormatAll]
[-Passphrase <String>]
[-Force]
[-DisableAutoUpgradeMinorVersion]
[-DefaultProfile <IAzureContextContainer>]
[-WhatIf]
[-Confirm]
[<CommonParameters>]
Description
The Set-AzVmssDiskEncryptionExtension cmdlet enables encryption on a VM scale set. This cmdlet enables encryption by installing the disk encryption extension on the VM scale set.
For Linux virtual machines, the VolumeType parameter must be present and must be set to "Data"
Examples
Example 1
$RGName = "MyResourceGroup"
$VmssName = "MyTestVmss"
$VaultName= "MyKeyVault"
$KeyVault = Get-AzKeyVault -VaultName $VaultName -ResourceGroupName $RGName
$DiskEncryptionKeyVaultUrl = $KeyVault.VaultUri
$KeyVaultResourceId = $KeyVault.ResourceId
Set-AzVmssDiskEncryptionExtension -ResourceGroupName $RGName -VMScaleSetName $VmssName -DiskEncryptionKeyVaultUrl $DiskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId
This command enables encryption on all disks of all Windows VMs in a VM scale set.
Example 2
$RGName = "MyResourceGroup"
$VmssName = "MyTestVmss"
$VaultName= "MyKeyVault"
$KeyVault = Get-AzKeyVault -VaultName $VaultName -ResourceGroupName $RGName
$DiskEncryptionKeyVaultUrl = $KeyVault.VaultUri
$KeyVaultResourceId = $KeyVault.ResourceId
$VolumeType = "Data"
Set-AzVmssDiskEncryptionExtension -ResourceGroupName $RGName -VMScaleSetName $VmssName -DiskEncryptionKeyVaultUrl $DiskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId `
-VolumeType $volumeType
This command enables encryption on the data disks of all Linux VMs in a VM scale set.
Parameters
-Confirm
Prompts you for confirmation before running the cmdlet.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False Aliases: cf
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-DefaultProfile
The credentials, account, tenant, and subscription used for communication with azure.
Parameter properties
Type: IAzureContextContainer
Default value: None Supports wildcards: False DontShow: False Aliases: AzContext, AzureRmContext, AzureCredential
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-DisableAutoUpgradeMinorVersion
Disable auto-upgrade of minor version
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-DiskEncryptionKeyVaultId
ResourceID of the KeyVault where generated encryption key will be placed to
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: 3 Mandatory: True Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-DiskEncryptionKeyVaultUrl
URL of the KeyVault where generated encryption key will be placed to
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: 2 Mandatory: True Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
EncryptFormatAll data drives that are not already encrypted
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-EncryptionIdentity
Resource ID of the managed identity with access to keyvault for ADE operations.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-ExtensionName
The extension name.
If this parameter is not specified, default values used are AzureDiskEncryption for Windows VMs and AzureDiskEncryptionForLinux for Linux VMs
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-ExtensionPublisherName
The extension publisher name. If this parameter is not specified, default value is Microsoft.Azure.Security for Windows VMs and Linux VMs
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-ExtensionType
The extension type. Specify this parameter to override its default value of "AzureDiskEncryption" for Windows VMs and "AzureDiskEncryptionForLinux" for Linux VMs.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-Force
To force enabling encryption on the virtual machine scale set.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-ForceUpdate
Generate a tag for force update. This should be given to perform repeated encryption operations on the same VM.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-KeyEncryptionAlgorithm
KeyEncryption Algorithm used to encrypt the volume encryption key
Parameter properties
Type: String
Default value: None Accepted values: RSA-OAEP, RSA1_5 Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-KeyEncryptionKeyUrl
Versioned KeyVault URL of the KeyEncryptionKey used to encrypt the disk encryption key
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-KeyEncryptionKeyVaultId
ResourceID of the KeyVault containing the KeyEncryptionKey used to encrypt the disk encryption key
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-Passphrase
The passphrase specified in parameters.
This parameter only works for Linux VM.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-ResourceGroupName
The resource group name to which the VM Scale Set belongs to
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: 0 Mandatory: True Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-TypeHandlerVersion
The type handler version.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False Aliases: HandlerVersion, Version
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-VMScaleSetName
Name of the virtual machine scale set
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False Aliases: Name
Parameter sets
(All)
Position: 1 Mandatory: True Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-VolumeType
Specifies the type of virtual machine volumes on which to perform encryption operation: OS, Data, or All.
Linux: The VolumeType parameter must be present and must be set to Data.
Windows: The VolumeType parameter, if present, must be set to either All or OS. If the VolumeType parameter is omitted it defaults to "All".
Parameter properties
Type: String
Default value: None Accepted values: OS, Data, All Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: True Value from remaining arguments: False
-WhatIf
Shows what would happen if the cmdlet runs.
The cmdlet is not run.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False Aliases: wi
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
-InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable,
-ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see
about_CommonParameters .
Outputs
