Enable Encryption at Host

Turn on Encryption at Host for your session hosts: register the Microsoft.Compute/EncryptionAtHost feature on your Azure subscription, and more.

Before you begin

  • An Atlas AVD administrator account
  • The Contributor (or Owner) role on the subscription for whoever registers the feature: Atlas's app registration when you use Register All, or you when you use the Azure CLI

Where you start

If you set up Atlas with the Cloud Shell installer, it has already started registering Microsoft.Compute/EncryptionAtHost on that subscription in the background. The first-run wizard leaves Encryption at Host off for new session hosts, so your first deployment never fails while the feature is still registering. Check that the feature shows Registered, then turn the setting on.

Step 1: Register the feature on your subscription

  1. Go to Administration → Tenants → Tenant List, open the tenant's Actions menu, and choose Manage.
  2. Under Azure Resource Providers, click Check Status. The table lists the resource providers AVD needs and, last, Microsoft.Compute/EncryptionAtHost with its current state.
  3. If it is not Registered, click Register All. More than five items are queued, so type the first 8 characters of the subscription ID to confirm, then click Register All.
  4. Registration is safe to repeat: anything already registered is skipped. Feature registration usually takes 10–15 minutes; click Check Status again to see the new state.

Confirming Register All

The confirmation names the subscription and the number of providers queued. Registering is a subscription-wide change in Azure, so make sure the subscription shown is the one your session hosts run in.

Or register it with the Azure CLI

If Atlas's app registration does not have Contributor on the subscription, register the feature yourself in Azure Cloud Shell. When the state reads Registered, re-register Microsoft.Compute so the change takes effect, then click Check Status in Atlas.

# GCC High only: point the CLI at Azure Government first
# az cloud set --name AzureUSGovernment

az account set --subscription <subscription-id>
az feature register --namespace Microsoft.Compute --name EncryptionAtHost
az feature show --namespace Microsoft.Compute --name EncryptionAtHost --query properties.state
az provider register --namespace Microsoft.Compute

The feature has the same name in Azure Government, so the same commands work for GCC High subscriptions. If your CLI points at Azure Commercial, run the commented az cloud set line first.

Step 2: Turn it on for new session hosts

Encryption at Host is a session-host default that every host pool inherits. Set it in the first-run wizard on the VM Defaults step, under Security & Compliance, or later in Global Settings. To use a different value for one pool, open that host pool's Settings and go to Network & Security → Host Security & Devices, where Encryption at Host can be overridden for the pool.

The setting applies to session hosts provisioned after you turn it on. Turn it on only once the feature shows Registered; otherwise Azure rejects the new VMs.

Next steps