According to Microsoft's documentation and examples, it should be possible to configure Azure Disk Encryption without using Azure AD; for example at https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-windows we have the following:
$rgName = 'MySecureRg'; $vmName = 'MySecureVM'; $KeyVaultName = 'MySecureVault'; $KeyVault = Get-AzureRmKeyVault -VaultName $KeyVaultName -ResourceGroupName $rgname; $diskEncryptionKeyVaultUrl = $KeyVault.VaultUri; $KeyVaultResourceId = $KeyVault.ResourceId; Set-AzureRmVMDiskEncryptionExtension -ResourceGroupName $rgname -VMName $vmName -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $KeyVaultResourceId;
However, when we attempt to run this script (replacing the variable values with our own names, of course) we get:
Set-AzureRmVmDiskEncryptionExtension : The input object cannot be bound because it did not contain the information required to bind all mandatory parameters: AadClientID AadClientSecret
Reviewing the documenation for Set-AzureRmVmDiskEncryptionExtension we once again see several examples given which do not use Azure AD, including and very explicitly Example 1 (which is a mere variant on the above) which states:
This example demonstrates enabling encryption without specifying AD credentials.
So: is there something missing here? Do we have a way to enable disk encryption without using Azure AD, or are the documentation and examples in error, and we do absolutely need Azure AD?
- Azure Powershell is at the latest version.
- Azure Disk Encryption with Azure AD App was not used in the past.
- I have reviewed "The solution doesn't support the following scenarios, features, and technology" section in the overview documentation and confirm that none of the unsupported cases apply.