To configure Azure Disk Encryption (ADE) for a Windows Server 2022 VM with a Key Encryption Key (KEK) from Azure Key Vault, first, enable ADE access in your Key Vault's access policies; then, create a KEK (RSA 3072/4096-bit for Win 2022) within that vault; and finally, use Azure CLI/PowerShell to apply ADE to the VM, specifying the KEK's details during the process, ensuring your VM/Key Vault are in the same region and have correct network access if using firewall rules.
Step 1: Configure Key Vault Access
Step 2: Create the Key Encryption Key (KEK)
You need a 4096-bit KEK (Key Encryption Key) for Azure Disk Encryption with Windows Server
2022 Datacenter: Azure Edition because that newer OS version and its integrated BitLocker require stronger, larger keys, as 2048-bit RSA keys are now considered insufficient or unsupported for this specific scenario, forcing a move to 3072 or 4096-bit keys for compatibility and enhanced security.
Reference:
https://learn.microsoft.com/en-us/answers/questions/5552951/issue-enabling-disk-encryption-on-windows-server-2