VM Disks, Encryption & Migration
Azure VMs need disks for storage and encryption for security. Learn about managed disks, encryption options, and how to move VMs between resource groups, subscriptions, or regions.
Managed disks
Managed disks are the hard drives for your Azure VMs — but Microsoft manages the underlying storage for you.
On-prem, you’d install SSDs or HDDs in your server and configure RAID. In Azure, you choose a disk type and size, and Azure handles the rest: redundancy, performance guarantees, and physical hardware management. You pick from four tiers based on how fast you need the disk.
| Disk Type | IOPS (max) | Best For |
|---|---|---|
| Ultra Disk | Up to 160,000 | IO-intensive: SAP HANA, top-tier databases |
| Premium SSD v2 | Up to 80,000 | Production workloads needing tuneable performance |
| Premium SSD | Up to 20,000 | Production VMs, enterprise applications |
| Standard SSD | Up to 6,000 | Web servers, dev/test, light workloads |
| Standard HDD | Up to 2,000 | Backups, non-critical data, infrequent access |
Key disk operations:
- Add data disks — attach additional disks to a VM for data storage (OS disk has the OS; data disks hold your data)
- Resize disks — increase disk size (can’t decrease). May require VM deallocation
- Change disk type — switch between Standard HDD, Standard SSD, and Premium SSD
- Create snapshots — point-in-time copy of a disk for backup or cloning
Encryption options
All managed disks have server-side encryption (SSE) enabled by default using Microsoft-managed keys. But there are additional options:
| Encryption Type | What It Encrypts | Key Management | Enabled By Default? |
|---|---|---|---|
| Server-Side Encryption (SSE) | Data at rest on the disk | Microsoft-managed or customer-managed keys | Yes (Microsoft keys) |
| Encryption at Host | Data on the VM host, temp disk, and cache | Microsoft-managed or customer-managed keys | No (must enable) |
| Azure Disk Encryption (ADE) | OS and data volumes inside the VM | Keys in Azure Key Vault | No (must enable) |
Exam tip: Encryption at Host vs Azure Disk Encryption
Encryption at Host ensures data is encrypted on the physical host machine BEFORE it reaches Azure Storage. This covers the temp disk and OS/data disk caches that standard SSE doesn’t cover.
Azure Disk Encryption (ADE) uses BitLocker (Windows) or dm-crypt (Linux) inside the VM to encrypt the OS and data volumes. Keys are stored in Azure Key Vault.
The exam often asks which encryption method covers the temp disk — the answer is Encryption at Host or ADE, not standard SSE.
Moving VMs
You can move VMs between resource groups, subscriptions, or regions:
| Move Type | Downtime? | What Moves Together |
|---|---|---|
| Between resource groups | No (metadata move) | VM + all dependent resources (disks, NICs, IPs) |
| Between subscriptions | No (metadata move) | VM + all dependent resources (both subs must be in same Entra tenant) |
| Between regions | Yes (requires recreating) | Use Azure Resource Mover or recreate from snapshot/image |
Exam tip: Moving VMs between regions
Moving a VM to a different region is NOT a simple move operation — you can’t just drag it. You need to: (1) create a snapshot of the disks, (2) copy the snapshot to the target region, (3) create new disks from the snapshot, (4) create a new VM in the target region using those disks. Azure Resource Mover can help automate this process.
Real-world: TechCorp migrates VMs between subscriptions
TechCorp Solutions needs to move their test VMs from the Dev subscription to a new Testing subscription (both under the same Entra tenant). Alex follows these steps:
- Verifies both subscriptions are in the same Entra tenant
- Checks that the VM size is available in the target subscription’s quota
- Moves the VM + all dependent resources (OS disk, data disks, NIC, public IP) together
- Updates any automation scripts that reference the old resource IDs
The move completes in minutes with zero downtime — it’s just a metadata change.
Knowledge check
Meridian Financial requires that the temporary disk on their VMs is encrypted. Which encryption option addresses this?
Alex needs to move a VM from the Dev resource group to the Prod resource group in the same subscription. Will there be downtime?
🎬 Video coming soon