The Big Picture
Azure gives you five overlapping ways to encrypt VM disk data. They sound similar, use some of the same terminology, and the Azure portal mixes them all together in the "Encryption" blade — which makes choosing correctly genuinely confusing. Then in late 2025, Microsoft announced that one of the most commonly used options — Azure Disk Encryption (ADE) — is being retired. If you have ADE-encrypted VMs and you do nothing before September 15, 2028, your disks will fail to unlock after any reboot.
Retirement alert: Azure Disk Encryption After September 15, 2028, ADE-enabled workloads will continue to run — but encrypted disks will fail to unlock after VM reboots, causing service disruption. All ADE-enabled VMs (including backups) must migrate before this date. There is no in-place migration path; you must rebuild the VM.
This article covers what each option actually does, where it operates in the stack, detailed pros and cons, and a clear decision guide — plus the full migration picture.