Skip to content

Commit 0d3a850

Browse files
v-shilsv-shils
authored
Merge pull request #312956 from svaldesgzz/aezkvedits
added KV article and refreshed TOC and overview
2 parents 98002c8 + 9989511 commit 0d3a850

5 files changed

Lines changed: 242 additions & 4 deletions

File tree

‎.github/copilot/skills/extended-zones-article-writer.md‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
# Extended Zones Article Writer
2+
3+
Write production-ready how-to, quickstart, tutorial, or overview articles for the Azure Extended Zones Learn documentation.
4+
5+
## Context Sources
6+
7+
### Existing articles (reference for style and structure)
8+
- **Directory:** `C:\github\azure-docs-pr\articles\extended-zones\`
9+
- **Best style reference:** `create-storage-account.md` (canonical how-to example)
10+
- **TOC:** `TOC.yml` — defines the site navigation structure
11+
- **Overview:** `overview.md` — contains the supported services table
12+
13+
### Team code repos (for technical accuracy)
14+
- `C:\github\AzureStack-Fiji-Workloads` — team workloads and service code
15+
- `C:\github\Extended-Zones-Core-Platform` — core platform code
16+
- `C:\github\Fiji-Services-EdgeZoneRP` — Edge Zone resource provider
17+
- `C:\github\Fiji-EdgeZones-TSG-TeamDocs` — troubleshooting and team docs
18+
- `C:\github\EdgeZones-Operations-Configuration` — operations config
19+
- `C:\github\EdgeZones-Operations-Validation` — validation scripts
20+
21+
---
22+
23+
## Frontmatter Template
24+
25+
```yaml
26+
---
27+
title: <Descriptive title — verb + noun + "in an Azure Extended Zone">
28+
description: <One sentence, under 160 characters, starting with "Learn how to...">
29+
author: svaldesgzz
30+
ms.author: svaldes
31+
ms.service: azure-extended-zones
32+
ms.topic: <how-to | quickstart | tutorial | overview | concept-article>
33+
ms.date: <MM/DD/YYYY>
34+
---
35+
```
36+
37+
---
38+
39+
## Article Naming Conventions
40+
41+
| Type | Pattern | Example |
42+
|---|---|---|
43+
| How-to | `[action]-[resource].md` | `create-storage-account.md` |
44+
| Quickstart | `deploy-[resource]-[method].md` | `deploy-vm-portal.md` |
45+
| Tutorial | `[action]-[resource].md` | `backup-virtual-machine.md` |
46+
| Overview | `overview.md` or `[topic]-overview.md` | `overview.md` |
47+
48+
---
49+
50+
## Article Structure by Type
51+
52+
### How-to guide (`ms.topic: how-to`)
53+
1. H1 title
54+
2. Intro paragraph ("In this article, you learn how to...")
55+
3. `## Prerequisites` — subscription, Extended Zone access, tools
56+
4. `## Sign in to Azure` — standard portal sign-in step
57+
5. Main task sections (H2 per major step)
58+
6. `## Clean up resources` — portal resource group deletion
59+
7. `## Related content` — 3–4 bullet links to related articles
60+
61+
### Quickstart (`ms.topic: quickstart`)
62+
Same as how-to but faster-paced, single focused task, ends with a "Next steps" section.
63+
64+
### Tutorial (`ms.topic: tutorial`)
65+
Multi-step, progressive task. Each H2 section builds on the previous one.
66+
67+
---
68+
69+
## Key Formatting Rules
70+
71+
**Tables** (use for all settings/configuration steps):
72+
```markdown
73+
| Setting | Value |
74+
| --- | --- |
75+
| Key vault name | Enter a unique name, such as *myKeyVault*. |
76+
| Region | Select the **parent region** of the target Extended Zone. |
77+
```
78+
79+
**Note/Important/Caution blocks:**
80+
```markdown
81+
> [!NOTE]
82+
> Note text here.
83+
84+
> [!IMPORTANT]
85+
> Critical info here.
86+
87+
> [!CAUTION]
88+
> Warning text here.
89+
```
90+
91+
**Code blocks** — always use language-specific fences:
92+
- Azure CLI: ` ```azurecli `
93+
- PowerShell: ` ```azurepowershell `
94+
- JSON: ` ```json `
95+
- Bash: ` ```bash `
96+
97+
**Cross-links** — use relative paths:
98+
```markdown
99+
[Request access to an Azure Extended Zone](request-access.md)
100+
```
101+
102+
**No screenshots** — use text instructions and tables only (no `:::image` directives).
103+
104+
---
105+
106+
## Extended Zone–Specific Notes
107+
108+
- **Key Vault, Disk Encryption Sets, and most control-plane services** are created in the **parent Azure region**, not the Extended Zone itself.
109+
- **VMs, AKS clusters, storage accounts** are deployed **in the Extended Zone** using `--edge-zone <zone-name>` in the CLI or by selecting "Deploy to an Azure Extended Zone" in the portal under the Region field.
110+
- Always remind users: select the **parent region** first in the portal, then select **Deploy to an Azure Extended Zone** and choose the Extended Zone.
111+
- Storage in Extended Zones is **Premium only** with **LRS** redundancy.
112+
- Refer to `request-access.md` whenever Extended Zone access or zone names are needed.
113+
114+
---
115+
116+
## Publishing Checklist
117+
118+
After writing the article:
119+
120+
1. **Save the file** to `C:\github\azure-docs-pr\articles\extended-zones\<filename>.md`
121+
122+
2. **Update `TOC.yml`** — add an entry under the appropriate section:
123+
```yaml
124+
- name: <Short descriptive name>
125+
href: <filename>.md
126+
```
127+
Sections in TOC: Overview, Quickstarts, Tutorials, Concepts, How-to guides, Arc-enabled PaaS workloads, Security, Reference, Resources
128+
129+
3. **Update `overview.md`** if the article covers a new service — add it to the supported services table under the correct category row (`Compute`, `Networking`, `Storage`, `BCDR`, `Arc-enabled PaaS`, `Other`). Services use `<br>` as separator and are written as markdown links.
130+
131+
4. **Verify frontmatter** — all required fields present (`title`, `description`, `author`, `ms.author`, `ms.service`, `ms.topic`, `ms.date`).

‎articles/extended-zones/TOC.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@
3737
href: purchase-reservations-savings-plans.md
3838
- name: Create a custom Azure Policy in an Extended Zone
3939
href: create-azure-policy.md
40+
- name: Encrypt disks with customer-managed keys in an Azure Extended Zone
41+
href: key-vault-encrypt-azure-extended-zone-disk.md
4042
- name: Arc-enabled PaaS workloads in Extended Zones
4143
items:
4244
- name: Create Arc-Enabled AKS Clusters in Extended Zones

‎articles/extended-zones/create-azure-policy.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ For this example, we created an Allowed Locations policy that restricts the loca
4343
**Required fields:**
4444

4545
| Field | Guidance |
46-
|------|---------|
46+
| ------ | --------- |
4747
| Definition location | Use a **management group** for enterprise-wide governance (recommended), or a **subscription** for more granular control. |
4848
| Name | Use a clear, intent-based name (for example, `Deny-NonApproved-Locations`). |
4949
| Description | Explain what the policy enforces and why. |

‎articles/extended-zones/key-vault-encrypt-azure-extended-zone-disk.md‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
---
2+
title: Encrypt disks with customer-managed keys in an Azure Extended Zone
3+
description: Learn how to use Azure Key Vault, Disk Encryption Sets, and Azure CLI to encrypt disks for virtual machines deployed in an Azure Extended Zone
4+
author: svaldesgzz
5+
ms.author: svaldes
6+
ms.service: azure-extended-zones
7+
ms.topic: how-to
8+
ms.date: 03/04/2026
9+
---
10+
11+
# Encrypt disks with customer-managed keys in an Azure Extended Zone
12+
13+
In this article, you learn how to encrypt Azure managed disks with **customer-managed keys (CMK)** for virtual machines deployed in an **Azure Extended Zone**.
14+
15+
The process uses **Azure Key Vault** and a **Disk Encryption Set (DES)**.
16+
17+
> [!NOTE]
18+
> While Key Vault and Disk Encryption Sets (DES) can be created using either the Azure portal or Azure CLI, assigning a Disk Encryption Set to disks for Azure Extended Zone workloads is currently supported only via Azure CLI.
19+
20+
## Prerequisites
21+
22+
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn).
23+
24+
- Access to an Extended Zone. For more information, see [Request access to an Azure Extended Zone](request-access.md).
25+
26+
- Azure CLI installed (version 2.26 or later). [Install Azure CLI](/cli/azure/install-azure-cli).
27+
28+
- Basic understanding of Azure Key Vault and disk encryption concepts. For more information, see [Azure Key Vault documentation](/azure/key-vault/general/overview) and [Azure Disk Encryption documentation](/azure/virtual-machines/windows/disk-encryption-overview).
29+
30+
## High-level architecture context
31+
32+
When using customer-managed keys with Azure Extended Zones resources:
33+
- Control plane operations (Azure Resource Manager, Key Vault metadata, DES) run in the parent Azure region.
34+
- Data plane resources (virtual machines and disks) run in the Extended Zone location.
35+
- Disk encryption is enforced at the managed disk level (data plane) using a Disk Encryption Set.
36+
37+
## Create a Key Vault and encryption key in an Azure Extended Zone
38+
39+
In this section, you create a Key Vault, encryption key and Disk Encryption Set in the parent region of an Extended Zone.
40+
41+
For this example, you have flexibility as to which tool to use to create the encryption tools, but the disk creation and encryption will only work via Azure CLI.
42+
43+
### Create a Key Vault and encryption key
44+
To encrypt resources in an Azure Extended Zone, you must first create an Azure Key Vault and an RSA key **in the parent Azure region associated with your Extended Zone**. You can do this using the Azure portal, or Azure CLI / PowerShell. When creating the Key Vault, ensure the following:
45+
- All the resources belong to the same resource group.
46+
- Azure role-based access control (RBAC) is enabled.
47+
- Purge protection is enabled.
48+
- You create or import an RSA key (2048-bit or higher).
49+
50+
51+
## Create a Disk Encryption Set (DES)
52+
Next, create a Disk Encryption Set that references the Key Vault key. The Disk Encryption Set must:
53+
- Be created in the same parent region as the Key Vault.
54+
- Use a system-assigned managed identity.
55+
56+
Grant the Disk Encryption Set access to the Key Vault key by assigning it the Key Vault Crypto Service Encryption User role.
57+
58+
## Deploy a virtual machine in an Azure Extended Zone
59+
When deploying a virtual machine in an Azure Extended Zone, you must specify:
60+
61+
--location: the parent Azure region
62+
63+
--edge-zone: the Extended Zone name
64+
65+
The following example creates a Windows Server 2022 VM in the Los Angeles Extended Zone, using West US as the parent region.
66+
67+
```cli
68+
az vm create --resource-group 'myResourceGroup' --name 'myVM' --image Win2022Datacenter --size Standard_DS4_v2 --admin-username 'username' --admin-password 'password' --edge-zone losangeles --location westus
69+
70+
```
71+
72+
## Create an encrypted managed disk using a Disk Encryption Set (CLI only)
73+
74+
After creating the VM, create a managed disk encrypted with your Disk Encryption Set. This step explicitly applies customer-managed keys to the disk.
75+
76+
```cli
77+
az disk create --resource-group 'myResourceGroup' --name 'myDisk' --edge-zone losangeles --location westus --size 64 --sku Premium_LRS --encryption-type EncryptionAtRestWithCustomerKey --disk-encryption-set DES_ID
78+
```
79+
80+
### Verify disk encryption
81+
82+
Use the following command to confirm that the disk is encrypted with a customer-managed key and associated with the correct Disk Encryption Set:
83+
84+
``` cli
85+
az disk show -g 'myResourceGroup' -n 'myDisk' --query "{encryptionType:encryption.type, desId:encryption.diskEncryptionSetId}" -o json
86+
```
87+
### Attach the encrypted disk to the VM
88+
89+
Finally, once verified, attach the encrypted disk to the VM using the following command:
90+
```cli
91+
az vm disk attach --resource-group 'myResourceGroup' --vm-name 'myVM' --name 'myDisk'
92+
```
93+
94+
## Clean up resources
95+
If you're done working with resources from this tutorial, use the following instructions to delete the resource group and all resources it contains:
96+
97+
```cli
98+
az group delete --name 'myResourceGroup' --yes --no-wait
99+
```
100+
101+
## Related content
102+
- [Azure Key Vault documentation](/azure/key-vault/general/overview)
103+
- [What is Azure Extended Zones?](overview.md)
104+
- [Deploy a virtual machine in an Extended Zone](deploy-vm-portal.md)
105+
- [Frequently asked questions](faq.md)

‎articles/extended-zones/overview.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -43,15 +43,15 @@ The following table lists key services that are available in Azure Extended Zone
4343

4444
| Service category | Available Azure services and features |
4545
| ------------------ | ------------------- |
46-
| **Compute** | [Azure Kubernetes Service](/azure/aks/extended-zones?tabs=azure-resource-manager)* <br> [Azure Virtual Desktop](/azure/virtual-desktop/azure-extended-zones)* <br> [Virtual Machine Scale Sets](/azure/virtual-machine-scale-sets/overview) <br> [Virtual machines](/azure/virtual-machines/overview) (general purpose: A, B, D, E, and F series and GPU NVadsA10 v5 series**)|
46+
| **Compute** | [Azure Kubernetes Service](/azure/aks/extended-zones?tabs=azure-resource-manager)* <br> [Azure Virtual Desktop](/azure/virtual-desktop/azure-extended-zones)* <br> [Virtual Machine Scale Sets](/azure/virtual-machine-scale-sets/overview) <br> [Virtual machines](/azure/virtual-machines/overview) (general purpose: A, B, D, E, and F series and GPU NVadsA10 v5 series**) |
4747
| **Networking** | [DDoS](../ddos-protection/ddos-protection-overview.md) (Standard protection) <br> [ExpressRoute](../expressroute/expressroute-introduction.md) <br> [Private Link](../private-link/private-link-overview.md) <br> [Standard Load Balancer](../load-balancer/load-balancer-overview.md) <br> [Standard public IP](../virtual-network/ip-services/public-ip-addresses.md) <br> [Virtual Network](../virtual-network/virtual-networks-overview.md) <br> [Virtual Network Peering](../virtual-network/virtual-network-peering-overview.md) <br> Azure Firewall (API version) |
4848
| **Storage** | [Managed disks](/azure/virtual-machines/managed-disks-overview) <br> - Premium SSD <br> - Standard SSD <br> [Premium Page Blobs](../storage/blobs/storage-blob-pageblob-overview.md) <br> [Premium Block Blobs](../storage/blobs/storage-blob-block-blob-premium.md) <br> [Premium Files](../storage/files/storage-files-introduction.md) <br> [Data Lake Storage Gen2 Hierarchical Namespace](../storage/blobs/data-lake-storage-namespace.md) <br>Data Lake Storage Gen2 Flat Namespace <br> [Change Feed](/azure/cosmos-db/change-feed) <br> Blob Features <br> - [SFTP](../storage/blobs/secure-file-transfer-protocol-support.md) <br> - [NFS](../storage/files/files-nfs-protocol.md) |
4949
| **BCDR** | [Azure Site Recovery](../site-recovery/site-recovery-overview.md)* (Extended Zone to parent region) <br> [Azure Backup](../backup/backup-overview.md) |
5050
| **Arc-enabled PaaS** | [ContainerApps](/azure/extended-zones/arc-enabled-workloads-container-apps)* <br> [ManagedSQL](/azure/extended-zones/arc-enabled-workloads-managed-sql)* |
51-
| **Other** | [Azure Policy](/azure/extended-zones/create-azure-policy)* <br> [Savings Plans](/azure/extended-zones/purchase-reservations-savings-plans) <br> [Reserved Instances](/azure/extended-zones/purchase-reservations-savings-plans) (through recommendations flow) |
51+
| **Other** | [Azure Key Vault](/azure/extended-zones/articles/extended-zones/key-vault-encrypt-azure-extended-zone-disk) (with encryption resources in parent region, targeting the Extended Zone) <br> [Azure Policy](/azure/extended-zones/create-azure-policy) <br> [Reserved Instances](/azure/extended-zones/purchase-reservations-savings-plans) (through recommendations flow) <br> [Savings Plans](/azure/extended-zones/purchase-reservations-savings-plans) |
5252

5353
\* While these services are GA in Azure Regions, they are currently in Preview in Azure Extended Zones.
54-
\** [Learn more about Virtual Machine family series here](/azure/virtual-machines/sizes/overview?tabs=breakdownseries%2Cgeneralsizelist%2Ccomputesizelist%2Cmemorysizelist%2Cstoragesizelist%2Cgpusizelist%2Cfpgasizelist%2Chpcsizelist). You can obtain a detailed VM list in the Azure Extended Zones environment.
54+
** [Learn more about Virtual Machine family series here](/azure/virtual-machines/sizes/overview?tabs=breakdownseries%2Cgeneralsizelist%2Ccomputesizelist%2Cmemorysizelist%2Cstoragesizelist%2Cgpusizelist%2Cfpgasizelist%2Chpcsizelist). You can obtain a detailed VM list in the Azure Extended Zones environment.
5555

5656
## Supported Independent Software Vendors (ISVs)
5757

0 commit comments

Comments
 (0)