Set-AzVMDiskEncryptionExtension

Set-AzVMDiskEncryptionExtension
    [-ResourceGroupName] <String>
    [-VMName] <String>
    [-DiskEncryptionKeyVaultUrl] <String>
    [-DiskEncryptionKeyVaultId] <String>
    [[-KeyEncryptionKeyUrl] <String>]
    [[-KeyEncryptionKeyVaultId] <String>]
    [[-KeyEncryptionAlgorithm] <String>]
    [[-VolumeType] <String>]
    [[-SequenceVersion] <String>]
    [[-TypeHandlerVersion] <String>]
    [[-Name] <String>]
    [[-Passphrase] <String>]
    [-EncryptionIdentity <String>]
    [-Force]
    [-DisableAutoUpgradeMinorVersion]
    [-SkipVmBackup]
    [-ExtensionType <String>]
    [-ExtensionPublisherName <String>]
    [-EncryptFormatAll]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Set-AzVMDiskEncryptionExtension
    [-ResourceGroupName] <String>
    [-VMName] <String>
    [-AadClientID] <String>
    [-AadClientSecret] <String>
    [-DiskEncryptionKeyVaultUrl] <String>
    [-DiskEncryptionKeyVaultId] <String>
    [[-KeyEncryptionKeyUrl] <String>]
    [[-KeyEncryptionKeyVaultId] <String>]
    [[-KeyEncryptionAlgorithm] <String>]
    [[-VolumeType] <String>]
    [[-SequenceVersion] <String>]
    [[-TypeHandlerVersion] <String>]
    [[-Name] <String>]
    [[-Passphrase] <String>]
    [-Force]
    [-DisableAutoUpgradeMinorVersion]
    [-SkipVmBackup]
    [-ExtensionType <String>]
    [-ExtensionPublisherName <String>]
    [-EncryptFormatAll]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Set-AzVMDiskEncryptionExtension
    [-ResourceGroupName] <String>
    [-VMName] <String>
    [-AadClientID] <String>
    [-AadClientCertThumbprint] <String>
    [-DiskEncryptionKeyVaultUrl] <String>
    [-DiskEncryptionKeyVaultId] <String>
    [[-KeyEncryptionKeyUrl] <String>]
    [[-KeyEncryptionKeyVaultId] <String>]
    [[-KeyEncryptionAlgorithm] <String>]
    [[-VolumeType] <String>]
    [[-SequenceVersion] <String>]
    [[-TypeHandlerVersion] <String>]
    [[-Name] <String>]
    [[-Passphrase] <String>]
    [-Force]
    [-DisableAutoUpgradeMinorVersion]
    [-SkipVmBackup]
    [-ExtensionType <String>]
    [-ExtensionPublisherName <String>]
    [-EncryptFormatAll]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Set-AzVMDiskEncryptionExtension
    [-ResourceGroupName] <String>
    [-VMName] <String>
    [[-KeyEncryptionAlgorithm] <String>]
    [[-VolumeType] <String>]
    [[-SequenceVersion] <String>]
    [[-TypeHandlerVersion] <String>]
    [[-Name] <String>]
    [[-Passphrase] <String>]
    [-Force]
    [-DisableAutoUpgradeMinorVersion]
    [-SkipVmBackup]
    [-ExtensionType <String>]
    [-ExtensionPublisherName <String>]
    [-EncryptFormatAll]
    [-Migrate]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Set-AzVMDiskEncryptionExtension
    [-ResourceGroupName] <String>
    [-VMName] <String>
    [[-KeyEncryptionAlgorithm] <String>]
    [[-VolumeType] <String>]
    [[-SequenceVersion] <String>]
    [[-TypeHandlerVersion] <String>]
    [[-Name] <String>]
    [[-Passphrase] <String>]
    [-Force]
    [-DisableAutoUpgradeMinorVersion]
    [-SkipVmBackup]
    [-ExtensionType <String>]
    [-ExtensionPublisherName <String>]
    [-EncryptFormatAll]
    [-MigrationRecovery]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [<CommonParameters>]

Set-AzVMDiskEncryptionExtension cmdlet 在 Azure 中正在运行的基础结构即服务（IaaS）虚拟机上启用加密。 它通过在虚拟机上安装磁盘加密扩展来启用加密。

此 cmdlet 需要用户确认，因为启用加密的步骤之一需要重启虚拟机。

建议在运行此 cmdlet 之前在虚拟机上保存工作。

Linux： 加密 Linux 虚拟机时需要 VolumeType 参数，并且必须设置为 Linux 分发支持的值（“Os”、“Data”或“All”。

Windows： 可以省略 VolumeType 参数，在这种情况下，操作默认为“全部”;如果 Windows 虚拟机存在 VolumeType 参数，则必须将其设置为“全部”或“OS”。

$RGName = "MyResourceGroup"
$VMName = "MyTestVM"
$VaultName= "MyKeyVault"
$KeyVault = Get-AzKeyVault -VaultName $VaultName -ResourceGroupName $RGName
$DiskEncryptionKeyVaultUrl = $KeyVault.VaultUri
$KeyVaultResourceId = $KeyVault.ResourceId
$VolumeType = "All"
Set-AzVMDiskEncryptionExtension -ResourceGroupName $RGName -VMName $VMName -DiskEncryptionKeyVaultUrl $DiskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId -VolumeType $VolumeType

此示例在不指定 AD 凭据的情况下在 VM 上启用加密。

$params = New-Object PSObject -Property @{
    ResourceGroupName = "[resource-group-name]"
    VMName = "[vm-name]"
    DiskEncryptionKeyVaultId = "/subscriptions/[subscription-id-guid]/resourceGroups/[resource-group-name]/providers/Microsoft.KeyVault/vaults/[keyvault-name]"
    DiskEncryptionKeyVaultUrl = "https://[keyvault-name].vault.azure.net"
    KeyEncryptionKeyVaultId = "/subscriptions/[subscription-id-guid]/resourceGroups/[resource-group-name]/providers/Microsoft.KeyVault/vaults/[keyvault-name]"
    KeyEncryptionKeyUrl = "https://[keyvault-name].vault.azure.net/keys/[kekname]/[kek-unique-id]"
    VolumeType = "All"
}

$params | Set-AzVMDiskEncryptionExtension

此示例使用管道输入发送参数，以便在 VM 上启用加密，而无需指定 AD 凭据。

$RGName = "MyResourceGroup"
$VMName = "MyTestVM"
$AADClientID = "<clientID of your Azure AD app>"
$AADClientSecret = "<clientSecret of your Azure AD app>"
$VaultName= "MyKeyVault"
$KeyVault = Get-AzKeyVault -VaultName $VaultName -ResourceGroupName $RGName
$DiskEncryptionKeyVaultUrl = $KeyVault.VaultUri
$KeyVaultResourceId = $KeyVault.ResourceId
$VolumeType = "All"
Set-AzVMDiskEncryptionExtension -ResourceGroupName $RGName -VMName $VMName -AadClientID $AADClientID -AadClientSecret $AADClientSecret -DiskEncryptionKeyVaultUrl $DiskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId -VolumeType $VolumeType

此示例使用 Microsoft Entra 客户端 ID 和客户端密码在 VM 上启用加密。

$RGName = "MyResourceGroup"
$VMName = "MyTestVM"
#The KeyVault must have enabledForDiskEncryption property set on it
$VaultName= "MyKeyVault"
$KeyVault = Get-AzKeyVault -VaultName $VaultName -ResourceGroupName $RGName
$DiskEncryptionKeyVaultUrl = $KeyVault.VaultUri
$KeyVaultResourceId = $KeyVault.ResourceId
$VolumeType = "All"

# create Azure AD application and associate the certificate
$CertPath = "C:\certificates\examplecert.pfx"
$CertPassword = "Password"
$Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($CertPath, $CertPassword)
$CertValue = [System.Convert]::ToBase64String($cert.GetRawCertData())
$AzureAdApplication = New-AzADApplication -DisplayName "<Your Application Display Name>" -HomePage "<https://YourApplicationHomePage>" -IdentifierUris "<https://YouApplicationUri>" -CertValue $CertValue
$ServicePrincipal = New-AzADServicePrincipal -ApplicationId $AzureAdApplication.ApplicationId

$AADClientID = $AzureAdApplication.ApplicationId
$aadClientCertThumbprint= $cert.Thumbprint

#Upload pfx to KeyVault
$KeyVaultSecretName = "MyAADCert"
$FileContentBytes = Get-Content $CertPath -Encoding Byte
$FileContentEncoded = [System.Convert]::ToBase64String($fileContentBytes)
$JSONObject = @"
    {
        "data" : "$filecontentencoded",
        "dataType" : "pfx",
        "password" : "$CertPassword"
    }
"@
$JSONObjectBytes = [System.Text.Encoding]::UTF8.GetBytes($jsonObject)
$JSONEncoded = [System.Convert]::ToBase64String($jsonObjectBytes)

$Secret = ConvertTo-SecureString -String $JSONEncoded -AsPlainText -Force
Set-AzKeyVaultSecret -VaultName $VaultName -Name $KeyVaultSecretName -SecretValue $Secret
Set-AzKeyVaultAccessPolicy -VaultName $VaultName -ResourceGroupName $RGName -EnabledForDeployment

#deploy cert to VM
$CertUrl = (Get-AzKeyVaultSecret -VaultName $VaultName -Name $KeyVaultSecretName).Id
$SourceVaultId = (Get-AzKeyVault -VaultName $VaultName -ResourceGroupName $RGName).ResourceId
$VM = Get-AzVM -ResourceGroupName $RGName -Name $VMName
$VM = Add-AzVMSecret -VM $VM -SourceVaultId $SourceVaultId -CertificateStore "My" -CertificateUrl $CertUrl
Update-AzVM -VM $VM -ResourceGroupName $RGName

#Enable encryption on the virtual machine using Azure AD client ID and client cert thumbprint
Set-AzVMDiskEncryptionExtension -ResourceGroupName $RGName -VMName $VMName -AadClientID $AADClientID -AadClientCertThumbprint $AADClientCertThumbprint -DiskEncryptionKeyVaultUrl $DiskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId -VolumeType $VolumeType

此示例使用 Microsoft Entra 客户端 ID 和客户端认证指纹在 VM 上启用加密。

$RGName = "MyResourceGroup"
$VMName = "MyTestVM"

$AADClientID = "<clientID of your Azure AD app>"
$AADClientSecret = "<clientSecret of your Azure AD app>"

$VaultName= "MyKeyVault"
$KeyVault = Get-AzKeyVault -VaultName $VaultName -ResourceGroupName $RGName
$DiskEncryptionKeyVaultUrl = $KeyVault.VaultUri
$KeyVaultResourceId = $KeyVault.ResourceId
$VolumeType = "All"

$KEKName = "MyKeyEncryptionKey"
$KEK = Add-AzKeyVaultKey -VaultName $VaultName -Name $KEKName -Destination "Software"
$KeyEncryptionKeyUrl = $KEK.Key.kid

Set-AzVMDiskEncryptionExtension -ResourceGroupName $RGName -VMName $VMName -AadClientID $AADClientID -AadClientSecret $AADClientSecret -DiskEncryptionKeyVaultUrl $DiskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId -KeyEncryptionKeyUrl $KeyEncryptionKeyUrl -KeyEncryptionKeyVaultId $KeyVaultResourceId -VolumeType $VolumeType

此示例使用 Microsoft Entra 客户端 ID 和客户端密码在 VM 上启用加密，并使用密钥加密密钥包装磁盘加密密钥。

$RGName = "MyResourceGroup"
$VMName = "MyTestVM"
#The KeyVault must have enabledForDiskEncryption property set on it
$VaultName= "MyKeyVault"
$KeyVault = Get-AzKeyVault -VaultName $VaultName -ResourceGroupName $RGName
$DiskEncryptionKeyVaultUrl = $KeyVault.VaultUri
$KeyVaultResourceId = $KeyVault.ResourceId
$KEKName = "MyKeyEncryptionKey"
$KEK = Add-AzKeyVaultKey -VaultName $VaultName -Name $KEKName -Destination "Software"
$KeyEncryptionKeyUrl = $KEK.Key.kid
$VolumeType = "All"

# create Azure AD application and associate the certificate
$CertPath = "C:\certificates\examplecert.pfx"
$CertPassword = "Password"
$Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($CertPath, $CertPassword)
$CertValue = [System.Convert]::ToBase64String($cert.GetRawCertData())
$AzureAdApplication = New-AzADApplication -DisplayName "<Your Application Display Name>" -HomePage "<https://YourApplicationHomePage>" -IdentifierUris "<https://YouApplicationUri>" -CertValue $CertValue
$ServicePrincipal = New-AzADServicePrincipal -ApplicationId $AzureAdApplication.ApplicationId

$AADClientID = $AzureAdApplication.ApplicationId
$AADClientCertThumbprint= $Cert.Thumbprint

#Upload pfx to KeyVault
$KeyVaultSecretName = "MyAADCert"
$FileContentBytes = Get-Content $CertPath -Encoding Byte
$FileContentEncoded = [System.Convert]::ToBase64String($FileContentBytes)
$JSONObject = @"
    {
        "data" : "$filecontentencoded",
        "dataType" : "pfx",
        "password" : "$CertPassword"
    }
"@
$JSONObjectBytes = [System.Text.Encoding]::UTF8.GetBytes($JSONObject)
$JsonEncoded = [System.Convert]::ToBase64String($JSONObjectBytes)
$Secret = ConvertTo-SecureString -String $JSONEncoded -AsPlainText -Force
Set-AzKeyVaultSecret -VaultName $VaultName-Name $KeyVaultSecretName -SecretValue $Secret
Set-AzKeyVaultAccessPolicy -VaultName $VaultName -ResourceGroupName $RGName -EnabledForDeployment

#deploy cert to VM
$CertUrl = (Get-AzKeyVaultSecret -VaultName $VaultName -Name $KeyVaultSecretName).Id
$SourceVaultId = (Get-AzKeyVault -VaultName $VaultName -ResourceGroupName $RGName).ResourceId
$VM = Get-AzVM -ResourceGroupName $RGName -Name $VMName
$VM = Add-AzVMSecret -VM $VM -SourceVaultId $SourceVaultId -CertificateStore "My" -CertificateUrl $CertUrl
Update-AzVM -VM $VM -ResourceGroupName $RGName

#Enable encryption on the virtual machine using Azure AD client ID and client cert thumbprint
Set-AzVMDiskEncryptionExtension -ResourceGroupName $RGname -VMName $VMName -AadClientID $AADClientID -AadClientCertThumbprint $AADClientCertThumbprint -DiskEncryptionKeyVaultUrl $DiskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId -KeyEncryptionKeyUrl $KeyEncryptionKeyUrl -KeyEncryptionKeyVaultId $KeyVaultResourceId -VolumeType $VolumeType

此示例使用 Microsoft Entra 客户端 ID 和客户端证书指纹在 VM 上启用加密，并使用密钥加密密钥包装磁盘加密密钥。

此 cmdlet 支持通用参数：-Debug、-ErrorAction、-ErrorVariable、-InformationAction、-InformationVariable、-OutBuffer、-OutVariable、-PipelineVariable、-ProgressAction、-Verbose、-WarningAction 和 -WarningVariable。 有关详细信息，请参阅 about_CommonParameters。