Virtual machines should use managed disks for OS and data disks
This control evaluates Azure virtual machines and confirms that all attached VM disks are managed. It examines the OS disk and each data disk on a virtual machine, and the evaluation passes only when every attached disk is a managed disk.
Using unmanaged disks ties VM data to storage account keys and SAS, increasing exposure of disk contents if those secrets leak (confidentiality/integrity). Limited platform resiliency and quotas increase availability risk. With Azure retiring unmanaged disks on 2026-03-31, such VMs may be stopped and unable to start.
What this control checks
Virtual machines use managed disks for the OS disk and data disks
Common pitfalls
Every OS and data disk must be a managed disk
Azure virtual machines must use managed disks for the OS disk and every data disk, rather than page blob VHD files in storage accounts. The evaluation confirms that all attached VM disks are managed.
Delete orphaned VHD blobs after migrating disks
After migration, delete orphaned VHD blobs to avoid data exposure and cost.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Audit VMs that do not use managed disks" (06a78e20-9358-41c9-923c-fb736d382a4d); Prowler check vm_ensure_using_managed_disks (prowler azure --checks vm_ensure_using_managed_disks); PowerPipe control azure_compliance.control.compute_vm_data_and_os_disk_uses_managed_disk.
Framework-specific interpretation
PCI DSS v4.0: Mapped to 3.5.1 (Primary account number (PAN) is secured wherever it is stored.).
Framework mappings
The clauses this control is mapped to in each framework.
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
RBI Cyber Security Framework for UCBs
- Annex I (1.1)
- 7.2 Ensure Virtual Machines are utilizing Managed Disks
- 7.2 Ensure Virtual Machines are utilizing Managed Disks
- 8.2 Ensure Virtual Machines are utilizing Managed Disks
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_vm_data_and_os_disk_uses_managed_disk - Powerpipe Control:
azure_compliance.control.compute_vm_data_and_os_disk_uses_managed_disk - Prowler Check:
vm_ensure_using_managed_disks - Azure Policy Definition:
06a78e20-9358-41c9-923c-fb736d382a4d
Last reviewed: 2026-10-11