Domain 3 of 4 · Chapter 2 of 3

Implement security for servers and virtual machines (VMs)

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing SC-500 premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • One machine, five control points
  • Where disk encryption happens in the stack
  • Customer-managed keys and the disk encryption set
  • Migrating off Azure Disk Encryption before it retires
  • Reaching the machine with Azure Bastion
  • Just-in-time VM access, from request to expiry
  • Bringing non-Azure servers into scope with Azure Arc
  • Selecting and scoping a Defender for Servers plan
  • Keeping a third-party antivirus without losing EDR
  • Agentless machine scanning
  • The gap between a plan and a running control
  • Boot integrity with trusted launch
  • Enforcing guest settings with Azure Machine Configuration
  • Exam-pattern recognition

Disk encryption at rest: what each of the four options covers

PropertyStorage server-side encryptionEncryption at hostAzure Disk EncryptionConfidential disk encryption
Where encryption happensAzure Storage clustersThe VM hostInside the guest OS (BitLocker or dm-crypt)Bound to the confidential VM's vTPM
OS and data disks at restYesYesYesYes, OS disk is the protected scope
Temporary diskNoYes, with platform-managed keysYesOpt-in
Disk cachesNoYesYesYes
Data encrypted between compute and storageNoYesYesYes
Customer-managed keysWith a disk encryption setWith a disk encryption setWith a key encryption key in Key VaultWith a disk encryption set
Consumes the VM's CPUNoNoYesYes
Lifecycle to plan aroundAlways on for managed disksEnable per VM or scale set; supported size and region neededRetires September 15, 2028Confidential VM sizes only

Decision tree

Must the disk be readable only by that VM, after attestation? yes Confidential disk encryption confidential VM size; temporary disk is opt-in no Must temporary disks and disk caches be encrypted? yes Encryption at host needs a supported VM size and region no Must the encryption run inside the guest OS? yes Azure Disk Encryption BitLocker or dm-crypt; retires September 15, 2028 no Azure Storage server-side encryption already on for managed OS and data disks Always: key ownership is a separate question customer-managed keys attach through a disk encryption set; Azure Disk Encryption takes a key encryption key
Cheat sheet

Cheat sheet

  • Managed disks use server-side encryption at rest by default
  • A disk encryption set binds managed disks to customer-managed keys
  • Encryption at host closes the cache and temporary-disk gap
  • Azure Disk Encryption performs guest-level volume encryption
  • Confidential disk encryption binds OS-disk access to the attested VM
  • Azure Disk Encryption workloads must migrate before retirement
  • Azure Bastion provides RDP and SSH without VM public IP addresses
  • A customer-deployed Bastion host requires AzureBastionSubnet
  • Just-in-time access keeps selected management ports closed by default
  • JIT enforces temporary access through the applicable network control
  • Bastion Premium is required for a private-only Bastion host
  • Delegate JIT access requests without granting policy configuration
  • Audit prior JIT operations from the configured VM's activity log
  • Azure Arc projects non-Azure servers into Azure Resource Manager
  • Arc connectivity enables Azure extensions and guest-policy controls
  • Defender for Servers centrally extends endpoint protection to Arc machines
  • Arc connection and Defender onboarding are separate states
  • Defender for Servers plans provide different protection depth
  • ForceDefenderPassiveMode preserves third-party antivirus while retaining EDR
  • Vulnerability assessment must be enabled and monitored as a Defender component
  • Agentless machine scanning inspects VM disks without a guest scanner
  • Agentless scanning complements rather than replaces EDR
  • Subscription-level endpoint integration onboards supported servers automatically
  • EDR in block mode preserves post-breach remediation with passive antivirus
  • Defender for Servers Plan 2 does not complete file integrity monitoring setup
  • Agentless machine scanning also inventories software and assesses EDR settings
  • The local Defender for Endpoint script is limited to small pilots
  • Trusted launch combines Secure Boot and virtual TPM protections
  • Integrity monitoring surfaces Trusted Launch attestation problems
  • Azure Machine Configuration evaluates settings inside the guest
  • Machine Configuration assignment mode determines whether drift is corrected

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. Server-side encryption of Azure managed disks
  2. Overview of managed disk encryption options
  3. About Azure confidential VMs
  4. Use the Azure portal to enable server-side encryption with customer-managed keys for managed disks
  5. What is Azure Bastion?
  6. About Azure Bastion configuration settings
  7. Deploy private-only Bastion
  8. Understand just-in-time virtual machine access
  9. Enable just-in-time access
  10. Azure Arc-enabled servers overview
  11. VM extension management with Azure Arc-enabled servers
  12. Connect on-premises machines to Microsoft Defender for Cloud
  13. Select a Defender for Servers plan
  14. Enable Defender for Endpoint integration in Microsoft Defender for Cloud
  15. Onboard Windows Servers using a local script
  16. Microsoft Defender Antivirus compatibility with other security products
  17. Endpoint detection and response in block mode
  18. Agentless machine scanning in Microsoft Defender for Cloud
  19. Enable agentless machine scanning
  20. Enable vulnerability scanning with Microsoft Defender Vulnerability Management
  21. Overview of file integrity monitoring in Microsoft Defender for Cloud
  22. Trusted launch for Azure VMs
  23. What is Azure Machine Configuration?
  24. Understand machine configuration assignment resources