Azure VM OS Disk Encryption Extension Failed During Patch Maintenance

Question

Azure VM OS Disk Encryption Extension Failed During Patch Maintenance

Fath Swift 0

Hi there,

I have an Azure VM where the BitLocker disk encryption extension failed during a scheduled patch maintenance operation. The OS disk encryption did not complete successfully, and I’d like to retry the encryption without recreating the VM.

What is the supported way to re-trigger the BitLocker encryption process or rerun the VM extension? Many thanks

0 comments

2 answers

Your answer

Answer 1

For a Windows Azure VM, the supported way to retry Azure Disk Encryption is to disable encryption and then enable it again. Removing or rerunning the extension alone is not sufficient.

Key points:

Disable encryption first.

PowerShell:

     Disable-AzVMDiskEncryption -ResourceGroupName "MyVirtualMachineResourceGroup" -VMName "MySecureVM" -VolumeType "all"

Azure CLI:

     az vm encryption disable --name "MySecureVM" --resource-group "MyVirtualMachineResourceGroup" --volume-type "all"

Wait for decryption to finish.
- Disabling encryption starts a background BitLocker decryption process.
- Give it enough time to complete before attempting to enable encryption again.
- If both OS and data disks are encrypted, disable encryption on all disks. Disabling only data disk encryption in that case can have unexpected results.
If needed, check encryption/decryption status.
- The documented status commands in the provided material are:
  - PowerShell: Get-AzVMDiskEncryptionStatus
  - Azure CLI: az vm encryption show
Remove the extension only after decryption completes, if cleanup is required.
- If the goal is to decrypt disks and remove the extension, disable encryption before removing the extension.
- If the extension is removed before disabling encryption, the disks remain encrypted. Disabling afterward reinstalls the extension to perform decryption, and it must then be removed again.
If the failure is specifically the Windows error Azure Disk Encryption extension version '2.2' is not supported, use one of these supported workarounds before retrying enablement:
- Use Set-AzVMDiskEncryptionExtension with the Microsoft Entra parameters:
  - -AadClientID
  - -AadClientSecret
- Or register the UnifiedDiskEncryptionForVMs feature for the subscription:
```
     Register-AzProviderFeature -ProviderNamespace "Microsoft.Compute" -FeatureName "UnifiedDiskEncryptionForVMs"
     Register-AzResourceProvider -ProviderNamespace Microsoft.Compute
```

If the VM is currently in a BitLocker boot-error state, a simple stop/deallocate and start is a documented first recovery step because it forces the VM to retrieve the BEK file from Azure Key Vault and place it on the encrypted disk.

References:

Answer 2

Hello Fath,

You normally do not need to recreate the VM. First check the current Azure Disk Encryption (ADE) state before removing or rerunning the extension:

Get-AzVMDiskEncryptionStatus ` -ResourceGroupName "MyResourceGroup" ` -VMName "MyVM"

If the previous encryption attempt left the VM in a failed or inconsistent state, Microsoft recommends using the ADE management commands rather than manually changing BitLocker inside the guest. If decryption is required, disable ADE and allow BitLocker decryption to fully complete before attempting encryption again.

Disable-AzVMDiskEncryption ` -ResourceGroupName "MyResourceGroup" ` -VMName "MyVM" ` -VolumeType "All"

After confirming decryption has completed, you can remove the ADE extension if necessary and then enable encryption again using Set-AzVMDiskEncryptionExtension with the same Key Vault/encryption configuration. Microsoft specifically warns against simply deleting the extension while disks remain encrypted, because removing the extension and disabling encryption are separate operations.

Also check the extension failure message and ADE logs before retrying, because Key Vault permissions, network access, or an unsupported encryption configuration can cause the retry to fail again.

One additional consideration for new deployments: Azure Disk Encryption is scheduled for retirement on September 15, 2028, and Microsoft recommends encryption at host for new VMs and migration of existing ADE workloads before that date.