Virtual machines should use managed disks
Virtual machine resources should set a managed disk. Prowler checks that the OS disk and every data disk are managed, rather than page blob VHDs in storage accounts. Checkov checks that `storage_os_disk.vhd_uri` is not set.
Using unmanaged disks ties VM data to storage account keys and SAS, increasing exposure of disk contents if those secrets leak (confidentiality/integrity). Limited platform resiliency and quotas increase availability risk. With Azure retiring unmanaged disks on 2026-03-31, such VMs may be stopped and unable to start.
What this control checks
VM OS and data disks must be managed disks, not page blob VHDs in storage accounts.
Audit evidence
Evidence that deployed resources meet this control: Prowler check vm_ensure_using_managed_disks (prowler azure --checks vm_ensure_using_managed_disks); PowerPipe controls azure_compliance.control.compute_vm_data_and_os_disk_uses_managed_disk and azure_compliance.control.compute_vm_utilizing_managed_disk.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV2_AZURE_9; KICS query "Beta - VM Without Managed Disk" (0536c90c-714e-4184-991e-3fed8d8b7b46).
Framework-specific interpretation
PCI DSS v4.0: Mapped to 3.5.1 (Primary account number (PAN) is secured wherever it is stored.).
Framework mappings
The clauses this control is mapped to in each framework.
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
RBI Cyber Security Framework for UCBs
- Annex I (1.1)
- 7.1 Ensure Virtual Machines are utilizing Managed Disks
- 7.1 Ensure Virtual Machines are utilizing Managed Disks
- 7.1 Ensure Virtual Machines are utilizing Managed Disks
- 7.2 Ensure Virtual Machines are utilizing Managed Disks
- 7.2 Ensure Virtual Machines are utilizing Managed Disks
- 8.2 Ensure Virtual Machines are utilizing Managed Disks
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_utilizing_managed_disk - Checkov Check:
CKV2_AZURE_9 - Powerpipe Controls:
azure_compliance.control.compute_vm_data_and_os_disk_uses_managed_disk,azure_compliance.control.compute_vm_utilizing_managed_disk - Prowler Check:
vm_ensure_using_managed_disks - KICS Query:
0536c90c-714e-4184-991e-3fed8d8b7b46
Last reviewed: 2026-10-11