The following matrix summarizes the supported restore scopes for various encryption modes.
| Restore scope | Server-side encryption |
Server-side encryption with CMK |
Azure Disk Encryption |
Encryption at host |
Confidential VM |
|---|---|---|---|---|---|
| Same region, same subscription | Yes | Yes | Yes | Yes | Yes |
| Same subscription, cross-region | Yes | Yes | Yes (in the same Azure geography) | Yes | Yes (in the same Azure geography) |
| Same region, cross-subscription | Yes | Yes | No | Yes | No |
| Cross-subscription, cross-region | Yes | Yes | No | Yes | No |
If you select a disk encryption set (DES), verify that the DES and the Azure Key Vault that manages its encryption keys are available in the destination region.
For a VM that uses Azure Key Vault encryption:
-
Restores to a different subscription are not supported because of an Azure limitation.
-
Restores to a different region in the same subscription create a new key vault. By default, the restored keys and secrets are not accessible to subscription users because the restore adds only the application's service principal to the key vault access control. When subscription users require access, the subscription administrator must update the key vault permissions in the Azure portal.
-
The Microsoft restrictions for Azure Key Vault-encrypted VMs affect backup and restore capabilities. Verify the destination key vault and access requirements before submitting an out-of-place restore.
For customer-managed keys, full VM restores from streaming backups complete, but the customer-managed key settings or disk encryption sets (DES) are not applied to the destination VM.