Get-AzureVMDiskEncryptionStatus

<#
.SYNOPSIS
    Reports encryption status for all VM managed disks.

.DESCRIPTION
    Checks every managed disk attached to every VM for encryption
    status, flagging any disk that is not encrypted with either platform
    managed or customer managed keys, ahead of a compliance audit.

.EXAMPLE
    .\Get-AzureVMDiskEncryptionStatus.ps1

.NOTES
    Requires the Az.Compute module and an active Connect-AzAccount session.

.AUTHOR
    Shehryar Hassan
#>

$disks = Get-AzDisk

$report = $disks | Select-Object Name, ResourceGroupName, DiskSizeGB,
    @{N="EncryptionType";E={$_.Encryption.Type}},
    @{N="Encrypted";E={$_.Encryption.Type -ne "EncryptionAtRestWithPlatformKey" -or $_.Encryption.Type}}

$unencrypted = $disks | Where-Object { -not $_.Encryption -or $_.Encryption.Type -eq "" }
$report | Format-Table Name, ResourceGroupName, DiskSizeGB, EncryptionType -AutoSize
Write-Warning "$($unencrypted.Count) disk(s) with no encryption configuration found."