Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
vm_ensure_using_managed_disksProvider: Azure
Service:
vmSeverity: HIGH
Categories:
resilienceResource type:
microsoft.compute/virtualmachinesWhat this check verifies
Azure virtual machines use managed disks for the OS disk and every data disk, rather than page blob VHDs in storage accounts. The evaluation confirms that all attached VM disks are managed.Risk
Using unmanaged disks ties VM data to storage account keys and SAS, increasing exposure of disk contents if those secrets leak (confidentiality/integrity). Limited platform resiliency and quotas increase availability risk. With Azure retiring unmanaged disks on2026-03-31, such VMs may be stopped and unable to start.
Recommendation
Adopt managed disks for all VM OS and data volumes.- Enforce least privilege via RBAC at disk scope
- Use encryption at rest; prefer
CMEKwhen mandated - Apply backups/snapshots and zone-aware designs for defense in depth
- After migration, delete orphaned VHD blobs to avoid data exposure and cost.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az vm convert —resource-group <RESOURCE_GROUP> —name <VM_NAME>
References
- https://learn.microsoft.com/en-us/azure/virtual-machines/unmanaged-disks-deprecation
- https://learn.microsoft.com/en-us/azure/virtual-machines/windows/convert-unmanaged-to-managed-disks
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/azure/VirtualMachines/managed-disks-in-use.html
- https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-data-protection#dp-4-enable-data-at-rest-encryption-by-default
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = vm_ensure_using_managed_disks. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks