Virtual machines and virtual machine scale sets should have encryption at host enabled
Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches.
Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches.
What this control checks
VMs and scale sets must have encryption_at_host_enabled set to true; missing or false fails.
Common pitfalls
Policy effect defaults to Audit
The policy effect parameter has a defaultValue of Audit. The allowed values are Audit, Deny and Disabled.
Temporary and ephemeral OS disks use platform-managed keys
Temporary and ephemeral OS disks are encrypted with platform-managed keys when encryption at host is enabled. OS/data disk caches are encrypted at rest with either customer-managed or platform-managed key, depending on the encryption type selected on the disk.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Virtual machines and virtual machine scale sets should have encryption at host enabled" (fc4d8e41-e223-45ea-9bf5-eada37891d87); PowerPipe control azure_compliance.control.compute_vm_and_sacle_set_encryption_at_host_enabled.
Scans of the Terraform code that flag the same setting before deployment: KICS query "Beta - VM Without Encryption At Host" (30c7c2f1-c048-49ba-81a4-ae465bbb3335).
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-28 (Protection of Information at Rest) and SC-28(1) (Cryptographic Protection).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-28 (Protection Of Information At Rest) and SC-28(1) (Cryptographic Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
FedRAMP Moderate Baseline Rev 4
- SC-28 (1): Cryptographic Protection
- SC-28(1) Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- SC.L2-3.13.16 Protect the confidentiality of CUI at rest
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_and_sacle_set_encryption_at_host_enabled - Powerpipe Control:
azure_compliance.control.compute_vm_and_sacle_set_encryption_at_host_enabled - Azure Policy Definition:
fc4d8e41-e223-45ea-9bf5-eada37891d87 - KICS Query:
30c7c2f1-c048-49ba-81a4-ae465bbb3335
Last reviewed: 2026-10-11