Skip to content

Use Managed Disks#

Reliability · Virtual Machine · Rule · 2020_06

Virtual machines (VMs) should use managed disks.

Description#

VMs can be configured with un-managed or managed disks. Un-managed disks, are .vhd files stored on a Storage Account that you manage as files. Managed disks are the successor to un-managed disks and improve durability and availability of VMs by the following:

  • Are designed for 99.999% availability.
  • Are replicated using Locally Redundant Storage or Zone Redundant Storage to improve durability.
  • Are aligned to the fault domains of VM availability sets.
  • Add support for availability zones to VM disk storage.

Additionally, managed disks provide the following benefits:

  • Simplified management by allowing you to managed the VM disk as a Azure resource instead of a file.
  • Improved security by providing granular access control using Azure Role-Based Access Control (RBAC).

Recommendation#

Consider using managed disks for virtual machine (VM) storage.

Examples#

Configure with Azure template#

To deploy VMs that pass this rule:

  • For operating system (OS) disks:
    • To create a new OS disk:
      1. Set the properties.storageProfile.osDisk.managedDisk.storageAccountType property to valid storage type.
      2. Set the properties.storageProfile.osDisk.createOption property to FromImage.
    • To use an existing OS disk:
      1. Set the properties.storageProfile.osDisk.createOption property to Attach.
      2. Set the properties.storageProfile.osDisk.managedDisk.id property to the resource ID of an existing disk resource.
  • For data disks:
    • To create a new data disk:
      1. Set the properties.storageProfile.dataDisks[*].managedDisk.storageAccountType property to valid storage type.
      2. Set the properties.storageProfile.dataDisks[*].createOption property to Empty or FromImage.
    • To use an existing data disk:
      1. Set the properties.storageProfile.dataDisks[*].managedDisk.id property to the resource ID of an existing disk resource.
      2. Set the properties.storageProfile.dataDisks[*].createOption property to Attach.

For example:

Azure Template snippet
{
  "type": "Microsoft.Compute/virtualMachines",
  "apiVersion": "2023-09-01",
  "name": "[parameters('name')]",
  "location": "[parameters('location')]",
  "zones": [
    "1"
  ],
  "properties": {
    "hardwareProfile": {
      "vmSize": "Standard_D2s_v3"
    },
    "osProfile": {
      "computerName": "[parameters('name')]",
      "adminUsername": "[parameters('adminUsername')]",
      "adminPassword": "[parameters('adminPassword')]"
    },
    "storageProfile": {
      "imageReference": {
        "publisher": "MicrosoftWindowsServer",
        "offer": "WindowsServer",
        "sku": "[parameters('sku')]",
        "version": "latest"
      },
      "osDisk": {
        "name": "[format('{0}-disk0', parameters('name'))]",
        "caching": "ReadWrite",
        "createOption": "FromImage",
        "managedDisk": {
          "storageAccountType": "Premium_LRS"
        }
      },
      "dataDisks": [
        {
          "createOption": "Attach",
          "lun": 0,
          "managedDisk": {
            "id": "[parameters('dataDiskId')]"
          }
        }
      ]
    },
    "networkProfile": {
      "networkInterfaces": [
        {
          "id": "[resourceId('Microsoft.Network/networkInterfaces', parameters('nicName'))]"
        }
      ]
    }
  },
  "dependsOn": [
    "[resourceId('Microsoft.Network/networkInterfaces', parameters('nicName'))]"
  ]
}

Configure with Bicep#

To deploy VMs that pass this rule:

  • For operating system (OS) disks:
    • To create a new OS disk:
      1. Set the properties.storageProfile.osDisk.managedDisk.storageAccountType property to valid storage type.
      2. Set the properties.storageProfile.osDisk.createOption property to FromImage.
    • To use an existing OS disk:
      1. Set the properties.storageProfile.osDisk.createOption property to Attach.
      2. Set the properties.storageProfile.osDisk.managedDisk.id property to the resource ID of an existing disk resource.
  • For data disks:
    • To create a new data disk:
      1. Set the properties.storageProfile.dataDisks[*].managedDisk.storageAccountType property to valid storage type.
      2. Set the properties.storageProfile.dataDisks[*].createOption property to Empty or FromImage.
    • To use an existing data disk:
      1. Set the properties.storageProfile.dataDisks[*].managedDisk.id property to the resource ID of an existing disk resource.
      2. Set the properties.storageProfile.dataDisks[*].createOption property to Attach.

For example:

Azure Bicep snippet
resource vm 'Microsoft.Compute/virtualMachines@2023-09-01' = {
  name: name
  location: location
  zones: [
    '1'
  ]
  properties: {
    hardwareProfile: {
      vmSize: 'Standard_D2s_v3'
    }
    osProfile: {
      computerName: name
      adminUsername: adminUsername
      adminPassword: adminPassword
    }
    storageProfile: {
      imageReference: {
        publisher: 'MicrosoftWindowsServer'
        offer: 'WindowsServer'
        sku: sku
        version: 'latest'
      }
      osDisk: {
        name: '${name}-disk0'
        caching: 'ReadWrite'
        createOption: 'FromImage'
        managedDisk: {
          storageAccountType: 'Premium_LRS'
        }
      }
      dataDisks: [
        {
          createOption: 'Attach'
          lun: 0
          managedDisk: {
            id: dataDiskId
          }
        }
      ]
    }
    networkProfile: {
      networkInterfaces: [
        {
          id: nic.id
        }
      ]
    }
  }
}

Configure with Azure Policy#

To address this issue at runtime use the following policies:

Comments