Add SecurityEncryptionType and SecureVMDiskEncryptionSet to Add-AzVMDataDisk for Confidential VM data disk encryption

[Copilot]

Confidential VMs (CVMs) already support confidential encryption for OS disks, but data disks lacked equivalent support — leaving data disk contents accessible outside the trusted execution environment. This PR closes that gap by enabling Confidential Disk Encryption (CDDE) for data disks via Add-AzVMDataDisk.

Changes

AddAzureVMDataDiskCommand.cs

• Added -SecurityEncryptionType (values: DiskWithVMGuestState, VMGuestStateOnly, NonPersistedTPM) scoped to VmManagedDiskParameterSet
• Added -SecureVMDiskEncryptionSet (ARM resource ID of a DES with ConfidentialVmEncryptedWithCustomerKey encryption type) scoped to VmManagedDiskParameterSet
• Execution path lazily creates ManagedDisk.SecurityProfile when either parameter is bound, consistent with how Set-AzVMOSDisk handles the same properties for OS disks

Help / Docs

• Updated Add-AzVMDataDisk.md syntax block, added parameter entries, and new Example 6 demonstrating CVM data disk creation

Tests

• New Test-AddAzVMDataDiskWithSecurityEncryption PS function covering: SecurityEncryptionType-only, and combined SecurityEncryptionType + SecureVMDiskEncryptionSet scenarios
• Corresponding [Fact] in VirtualMachineProfileTests.cs

Example

$vm = Add-AzVMDataDisk -VM $vm -Name "ConfidentialData" -Lun 0 -CreateOption Attach `
    -ManagedDiskId $diskId -StorageAccountType 'Premium_LRS' `
    -SecurityEncryptionType 'DiskWithVMGuestState' `
    -SecureVMDiskEncryptionSet $desId

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• 1n8vsblobprodwus2184.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• 40vvsblobprodwus2135.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• 6yfvsblobprodwus2121.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• 7q7vsblobprodwus2144.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• 84hvsblobprodwus2148.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• 8wdvsblobprodwus2137.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• b53vsblobprodwus2154.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• ba0vsblobprodwus2130.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• balvsblobprodwus2129.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• cffvsblobprodwus218.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• d94vsblobprodwus2119.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• ezcvsblobprodwus2170.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• faxvsblobprodwus2122.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• g3xvsblobprodwus2151.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• i01vsblobprodwus216.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• jhgvsblobprodwus2167.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• k4pvsblobprodwus2140.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• ldhvsblobprodwus2153.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• mt2vsblobprodwus2110.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• nudvsblobprodwus214.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• p2tvsblobprodwus2189.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• tn2vsblobprodwus2124.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• wlnvsblobprodwus2188.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)
• y5lvsblobprodwus2179.vsblob.vsassets.io
  • Triggering command: /usr/bin/dotnet dotnet build src/Compute/Compute/Compute.csproj (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Powershell support for Confidential data disk encryption: creating data disk with new security type and confidential DES</issue_title>
<issue_description>The Ask: Add support for creating data disk with new security type and confidential DES

Business need:

Currently, while Confidential VMs (CVMs) support confidential encryption for operating system disks, data disks still rely on non-confidential methods, creating a critical gap in Azure’s sovereignty promise for critical customers like G42. This gap affects not only migrated VMs but also newly provisioned CVMs, leaving sensitive customer data on data disks exposed and undermining the value proposition of Azure Confidential Computing (ACC). For G42, whose workloads are largely legacy IaaS applications migrated via Azure Migrate, the inability to confidentially encrypt data disks means that sensitive information remains vulnerable to host access, failing to meet customer expectations for end-to-end confidentiality and regulatory compliance. The absence of CDDE is quickly apparent to auditors and regulators, posing significant reputational and onboarding risks, especially as risk acceptance by customers is volatile and may not persist with changes in personnel or regulatory scrutiny. Without a committed timeline for CDDE, customers question Azure’s commitment to security and may reconsider the value of CVMs, opting instead for alternatives like RBAC and CMK that offer demonstrable control and auditability. To fully deliver on the promise of confidential computing and maintain customer trust, it is essential that confidential data disk encryption be prioritized and brought to General Availability as soon as possible.

Overview:
Confidential encryption binds the disk encryption keys to the virtual machine’s TPM (Trusted Platform Module) and makes the disk content accessible only to the VM. This is currently available for OS disks in GA. We also enabled confidential encryption of temp disks (in public preview) using in-VM symmetric key encryption technology, after the disk is attached to the confidential VM (CVM). Similarly, we need a robust long-term solution to assert that the customer’s data on data disks is always encrypted with the keys bound in the trusted environment, so the data can never be accessed by unauthorized Microsoft operators.

PM Contact
kartikg@microsoft.com

Engineer Contact
vimish@microsoft.com]</issue_description>

Comments on the Issue (you are @copilot in this section)

Custom agent used: Compute PowerShell Pull Request Agent
Specialized agent for creating PowerShell pull requests based on a design request

• Fixes Azure/azure-powershell-cmdlet-review-pr#1525

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[azure-client-tools-bot-prd]

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.