Understanding Azure virtual machine disks

Azure VMs are a part of Microsoft's Infrastructure as a Service (IaaS) offering and another service that a lot of users encounter early in the cloud journey. Azure VMs are usually selected when the user requires more control over the environment than other services can offer. But with more control also comes more responsibility.

Besides network management, which was covered in Chapter 4, Azure Network Security, we need to address how we handle data in Azure VMs, and by data, we mainly mean disks. Just like all other data, disks for Azure VM are encrypted at rest, and VM uses Azure Fabric Controller to securely access content stored on these disks.

But what happens if we decide to download or export a disk used by these machines? Once a disk leaves Azure, it is in an unencrypted state and can be used in any way. This opens certain vulnerabilities that need to be addressed. What if someone gains access to Azure (but does not have...