Azure Compliance ControlsAzure Virtual Machines
Virtual machines and virtual machine scale sets should have encryption at host enabled
Use encryption at host to get end-to-end encryption for your virtual machine and virtual machine scale set data. Encryption at host enables encryption at rest for your temporary disk and OS/data disk caches.
What this control checks
VMs and scale sets must have encryption_at_host_enabled set to true; missing or false fails.
Framework mappings
The clauses this control is mapped to in each framework.
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
FedRAMP Moderate Baseline Rev 4
- SC-28 (1): Cryptographic Protection
- SC-28(1) Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- SC.L2-3.13.16 Protect the confidentiality of CUI at rest
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_and_sacle_set_encryption_at_host_enabled - Powerpipe Control:
azure_compliance.control.compute_vm_and_sacle_set_encryption_at_host_enabled - Azure Policy Definition:
fc4d8e41-e223-45ea-9bf5-eada37891d87 - KICS Query:
30c7c2f1-c048-49ba-81a4-ae465bbb3335
Last reviewed: 2026-10-11