About

This compliance check from the Azure integration looks at the managed disks in your client's Azure subscription, both attached and unattached. A disk can hold sensitive information, so each one should be encrypted with a customer-managed key (CMK). With a customer-managed key, your client controls key management, such as key rotation and key vault monitoring.

Results for Azure checks appear in Monitor › Compliance Checks. If the check shows Failing, follow the steps below to switch the affected disks to a customer-managed key.

Encrypt a managed disk with a customer-managed key

You do these steps in the Azure portal, not in ControlMap. Repeat them for each disk that needs fixing:

1. In the Azure portal, go to Disks under resources.
2. Select the disk you want to fix.
3. Under Settings, select Encryption.
4. Under Encryption type, select Encryption at-rest with a customer-managed key.
5. In the Disk encryption set drop-down, select an existing disk encryption set.
6. Select Save before you leave the page.

More information

Microsoft explains disk encryption in Azure here: https://docs.microsoft.com/en-us/azure/virtual-machines/disk-encryption