Unattached disk uses a customer-managed key

# Associate an unattached managed disk with a Disk Encryption Set (CMK)
resource "azurerm_managed_disk" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<location>"
  resource_group_name = "<example_resource_name>"
  create_option       = "Empty"
  disk_size_gb        = 1

  disk_encryption_set_id = "<example_resource_id>" # CRITICAL: enables CMK by linking the Disk Encryption Set
}

// Update an existing managed disk to use a customer-managed key via Disk Encryption Set
resource example_disk 'Microsoft.Compute/disks@2023-08-01' = {
  name: '<example_resource_name>'
  location: '<location>'
  properties: {
    encryption: {
      type: 'EncryptionAtRestWithCustomerKey' // CRITICAL: switch to CMK-based encryption
      diskEncryptionSetId: '<example_resource_id>' // CRITICAL: DES resource ID that holds the CMK
    }
  }
}