Microsoft announced in May that it supported full disk encryption for VMs. They have recently merged a github branch into the Azure Powershell tools to enable this.

The basic theory is that you store encryption keys in an Azure Key Vault HSM, point the VM to it, it retrieves its keys, unlocks the disk and you're away.

However I am not entirely sure what this is protecting me from! The only case I can think of is that somebody obtains my blob storage credentials and uses them to download the VM disk (or someone infiltrates the underlying blob storage infrastructure - this seems unlikely) I can't imagine that this would offer any protection against any sort of law enforcement request as Microsoft own the hardware that contains my key and so would be able to hand over the whole thing.

What is the attack vector that cloud based full disk encryption protects me against? (what am I missing!)

*note this is not specifically an Azure question, as the answer should apply to all cloud vendors.

Microsoft announced in May that it supported full disk encryption for VMs. They have recently merged a github branch into the Azure Powershell tools to enable this.

The basic theory is that you store encryption keys in an Azure Key Vault HSM, point the VM to it, it retrieves its keys, unlocks the disk and you're away.

However I am not entirely sure what this is protecting me from! The only case I can think of is that somebody obtains my blob storage credentials and uses them to download the VM disk (or someone infiltrates the underlying blob storage infrastructure - this seems unlikely) I can't imagine that this would offer any protection against any sort of law enforcement request as Microsoft own the hardware that contains my key and so would be able to hand over the whole thing.

What is the attack vector that cloud based full disk encryption protects me against? (what am I missing!)

*note this is not specifically an Azure question, as the answer should apply to all cloud vendors.