1. Log in to the Azure portal and navigate to the “Security Center” dashboard.
2. Click on the “Security policy” tab on the left-hand side of the screen.
3. Under the “Policy initiatives” section, click on the “Enable monitoring of disk encryption” initiative.
4. Click on the “Remediate” button at the bottom of the screen.
5. In the pop-up window, review the remediation steps and click on the “Remediate” button again to confirm.
6. Wait for the remediation process to complete. This may take several minutes.
7. Once the remediation process is complete, verify that the “Monitor Disk Encryption setting” is now enabled by navigating to the “Security policy” tab and reviewing the policy compliance status.

​

1. Open Azure CLI in your terminal or command prompt.
2. Login to your Azure account using the command:
   az login
   
3. Once you are logged in, set the Azure subscription that you want to work with using the command:
   az account set --subscription <subscription-id>
   
4. Next, enable the Disk Encryption Monitoring setting for the virtual machines in your Azure account using the command:
   az monitor diagnostic-settings create --name <diagnostic-settings-name> --resource <vm-resource-id> --logs '[{"category": "DiskEncryption", "enabled": true}]'
   
   Replace <diagnostic-settings-name> with a name for the diagnostic settings, and <vm-resource-id> with the resource ID of the virtual machine that you want to enable disk encryption monitoring for. Note: If you want to enable disk encryption monitoring for all virtual machines in your Azure account, you can use the command:
   az monitor diagnostic-settings create --name <diagnostic-settings-name> --resource <vm-resource-id> --logs '[{"category": "DiskEncryption", "enabled": true}]' --scope /subscriptions/<subscription-id>
   
   Replace <subscription-id> with your Azure subscription ID.
5. Verify that the Disk Encryption Monitoring setting is enabled for the virtual machine(s) using the command:
   az monitor diagnostic-settings show --name <diagnostic-settings-name> --resource <vm-resource-id>
   
   This command will show the diagnostic settings for the specified virtual machine, including the Disk Encryption Monitoring setting.

1. Install the Azure Python SDK by running the following command in your terminal:
   pip install azure-mgmt-compute
   
2. Authenticate with Azure by creating a Service Principal and setting the environment variables AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, and AZURE_TENANT_ID. You can follow the instructions in the Azure documentation to create a Service Principal: https://docs.microsoft.com/en-us/azure/developer/python/azure-sdk-authenticate?tabs=cmd#authenticate-with-a-service-principal
3. Use the following Python code to enable disk encryption monitoring for all virtual machines in the subscription:
   from azure.common.credentials import ServicePrincipalCredentials
   from azure.mgmt.compute import ComputeManagementClient
   from azure.mgmt.monitor import MonitorManagementClient
   from azure.mgmt.monitor.models import EventData
   
   # Set the credentials and subscription ID
   credentials = ServicePrincipalCredentials(
       client_id=os.environ['AZURE_CLIENT_ID'],
       secret=os.environ['AZURE_CLIENT_SECRET'],
       tenant=os.environ['AZURE_TENANT_ID']
   )
   subscription_id = 'your-subscription-id'
   
   # Create the Compute and Monitor clients
   compute_client = ComputeManagementClient(credentials, subscription_id)
   monitor_client = MonitorManagementClient(credentials, subscription_id)
   
   # Get all virtual machines in the subscription
   vms = compute_client.virtual_machines.list_all()
   
   # Enable disk encryption monitoring for each virtual machine
   for vm in vms:
       resource_id = vm.id
       event_data = EventData(
           category='Policy',
           resource_id=resource_id,
           operation_name='Microsoft.Compute/virtualMachines/write',
           status='Succeeded',
           description='Disk encryption monitoring enabled'
       )
       monitor_client.activity_log_alerts.create_or_update(
           resource_group_name='your-resource-group-name',
           activity_log_alert_name='disk-encryption-monitoring',
           condition={
               'all_of': [
                   {
                       'field': 'category',
                       'equals': 'Policy'
                   },
                   {
                       'field': 'resourceId',
                       'equals': resource_id
                   },
                   {
                       'field': 'operationName',
                       'equals': 'Microsoft.Compute/virtualMachines/write'
                   },
                   {
                       'field': 'status',
                       'equals': 'Succeeded'
                   }
               ]
           },
           enabled=True,
           description='Alert for enabling disk encryption monitoring',
           actions=[event_data],
           tags={}
       )
   
   This code will create an Activity Log alert called “disk-encryption-monitoring” for each virtual machine in the subscription, with the condition that the operation “Microsoft.Compute/virtualMachines/write” succeeds and the resource ID matches the virtual machine. When this condition is met, the alert will trigger an event that enables disk encryption monitoring for the virtual machine.
4. Save the code to a Python file and run it using the python command in your terminal:
   python enable_disk_encryption_monitoring.py
   
   This will enable disk encryption monitoring for all virtual machines in the subscription.

resource "azurerm_subscription_policy_assignment" "vm_disk_encryption_monitor" {
  name                 = "vm-disk-encryption-monitor"
  display_name         = "Monitor VM Disk Encryption"
  description          = "Enable Security Center recommendations for virtual machine disk encryption."
  subscription_id      = SUBSCRIPTION_ID # replace with the target subscription ID
  policy_definition_id = "/providers/Microsoft.Authorization/policyDefinitions/19a52e8c-f6ed-4528-85a0-8c4bfa0d4c41"

  # Enable the policy so Security Center audits VMs without disk encryption
  parameters = jsonencode({
    effect = {
      value = "AuditIfNotExists"
    }
  })
}

• Replace SUBSCRIPTION_ID with the subscription you want Azure Security Center to monitor.
• If you already manage this exact policy assignment in Terraform, update its parameters block instead of creating a new resource. Changing only parameters is an in-place update and does not cause downtime.