Update Set-AzVMOSDisk.md (#26736)

* Update Set-AzVMOSDisk.md

Fixed typos in a couple of variable names
Added called but undeclared variables to stop script failing
Updated some commands to reflect current syntax
Added -DisableRbacAuthorization for KeyVault
Tested 7.4.5 core (MacOS) and 7.4.6 core (Windows)

* Update Set-AzVMOSDisk.md

* Update Set-AzVMOSDisk.md

---------

Co-authored-by: Yabo Hu <[email protected]>

Author: vinfnet

src/Compute/Compute/help/Set-AzVMOSDisk.md

@@ -127,36 +127,45 @@ This example sets the disk encryption settings on a virtual machine operating sy
 
 ### Example 5: Create a ConfidentialVM virtual machine with VM OS Disk encryption of DiskWithVMGuestState, and Disk Encryption Set encryption of ConfidentialVmEncryptedWithCustomerKey.
 ```powershell
-# Create Resource Group
-$Location = 'northeurope';
-New-AzResourceGroup -Name $ResourceGroupName -Location $Location;
-
+$keyVaultName="your keyvault name"
+$keyName="your key name"
 $vmSize = "Standard_DC2as_v5";        
 $identityType = "SystemAssigned";
 $secureEncryptGuestState = "DiskWithVMGuestState";
 $vmSecurityType = "ConfidentialVM";
-$securePassword = ConvertTo-SecureString -String "****" -AsPlainText -Force; 
+$user = "your user name";
+$desName = "your disk encryption set name";
+$vmname = "your vm name";
+$computerName = "your computer name"; 
+$ResourceGroupName = 'your resource group name'
+$Location = 'northeurope'
+
+# Create Resource Group
+New-AzResourceGroup -Name $ResourceGroupName -Location $Location -force;
+
+#create a credential object
+$securePassword = ConvertTo-SecureString -String "Password to your virtual machine here" -AsPlainText -Force; 
 $cred = New-Object System.Management.Automation.PSCredential ($user, $securePassword);
 
 # Create Key Vault
-New-AzKeyVault -Name $keyVaultName -Location $Location -ResourceGroupName $ResourceGroupName -Sku Premium -EnablePurgeProtection -EnabledForDiskEncryption;
+New-AzKeyVault -Name $keyVaultName -Location $Location -ResourceGroupName $ResourceGroupName -Sku Premium -EnabledForDiskEncryption -DisableRbacAuthorization -SoftDeleteRetentionInDays 10 -EnablePurgeProtection;
 
-$cvmAgent = Get-AzADServicePrincipal -ApplicationId '00001111-aaaa-2222-bbbb-3333cccc4444';
+$cvmAgent = Get-AzADServicePrincipal -ApplicationId 'bf7b6499-ff71-4aa2-97a4-f372087be7f0'; #AppID of CVM Agent, this is a constant value but locate the SP ID for your tenant
 Set-AzKeyVaultAccessPolicy -VaultName $keyVaultName -ResourceGroupName $ResourceGroupName -ObjectId $cvmAgent.id -PermissionsToKeys get,release;
 
 # Add Key vault Key
 $KeyName = "keyname";
 $KeySize = 3072;
 
-Add-AzKeyVaultKey -VaultName $kvname -Name $KeyName -Size $KeySize -KeyOps wrapKey,unwrapKey -KeyType RSA -Destination HSM -Exportable -UseDefaultCVMPolicy;
+Add-AzKeyVaultKey -VaultName $keyVaultName -Name $KeyName -Size $KeySize -KeyOps wrapKey,unwrapKey -KeyType RSA -Destination HSM -Exportable -UseDefaultCVMPolicy;
         
 # Capture Key Vault and Key details
 $encryptionKeyVaultId = (Get-AzKeyVault -VaultName $keyVaultName -ResourceGroupName $ResourceGroupName).ResourceId;
 $encryptionKeyURL = (Get-AzKeyVaultKey -VaultName $keyVaultName -KeyName $keyName).Key.Kid;
 
 # Create new DES Config and Disk Encryption Set
 $diskEncryptionType = "ConfidentialVmEncryptedWithCustomerKey";
-$desConfig = New-AzDiskEncryptionSetConfig -Location $loc -SourceVaultId $encryptionKeyVaultId -KeyUrl $encryptionKeyURL -IdentityType SystemAssigned -EncryptionType $diskEncryptionType;
+$desConfig = New-AzDiskEncryptionSetConfig -Location $Location -SourceVaultId $encryptionKeyVaultId -KeyUrl $encryptionKeyURL -IdentityType SystemAssigned -EncryptionType $diskEncryptionType;
 New-AzDiskEncryptionSet -ResourceGroupName $ResourceGroupName -Name $desName -DiskEncryptionSet $desConfig;
         
 $diskencset = Get-AzDiskEncryptionSet -ResourceGroupName $rgname -Name $desName;
@@ -171,25 +180,27 @@ $VirtualMachine = Set-AzVMOperatingSystem -VM $VirtualMachine -Windows -Computer
 $VirtualMachine = Set-AzVMSourceImage -VM $VirtualMachine -PublisherName 'MicrosoftWindowsServer' -Offer 'windowsserver' -Skus '2022-datacenter-smalldisk-g2' -Version "latest";
         
 $subnet = New-AzVirtualNetworkSubnetConfig -Name ($subnetPrefix + $ResourceGroupName) -AddressPrefix "10.0.0.0/24";
-$vnet = New-AzVirtualNetwork -Force -Name ($vnetPrefix + $ResourceGroupName) -ResourceGroupName $ResourceGroupName -Location $loc -AddressPrefix "10.0.0.0/16" -Subnet $subnet;
+$vnet = New-AzVirtualNetwork -Force -Name ($vnetPrefix + $ResourceGroupName) -ResourceGroupName $ResourceGroupName -Location $Location -AddressPrefix "10.0.0.0/16" -Subnet $subnet;
 $vnet = Get-AzVirtualNetwork -Name ($vnetPrefix + $ResourceGroupName) -ResourceGroupName $ResourceGroupName;
 $subnetId = $vnet.Subnets[0].Id;
-$pubip = New-AzPublicIpAddress -Force -Name ($pubIpPrefix + $ResourceGroupName) -ResourceGroupName $ResourceGroupName -Location $loc -AllocationMethod Dynamic -DomainNameLabel $domainNameLabel2;
+$pubip = New-AzPublicIpAddress -Force -Name ($pubIpPrefix + $ResourceGroupName) -ResourceGroupName $ResourceGroupName -Location $Location -AllocationMethod Static -DomainNameLabel $domainNameLabel2;
 $pubip = Get-AzPublicIpAddress -Name ($pubIpPrefix + $ResourceGroupName) -ResourceGroupName $ResourceGroupName;
 $pubipId = $pubip.Id;
-$nic = New-AzNetworkInterface -Force -Name ($nicPrefix + $ResourceGroupName) -ResourceGroupName $ResourceGroupName -Location $loc -SubnetId $subnetId -PublicIpAddressId $pubip.Id;
+
+
+$nic = New-AzNetworkInterface -Force -Name ($nicPrefix + $ResourceGroupName) -ResourceGroupName $ResourceGroupName -Location $Location -SubnetId $subnetId -PublicIpAddressId $pubip.Id;
 $nic = Get-AzNetworkInterface -Name ($nicPrefix + $ResourceGroupName) -ResourceGroupName $ResourceGroupName;
 $nicId = $nic.Id;
 
 $VirtualMachine = Add-AzVMNetworkInterface -VM $VirtualMachine -Id $nicId;
 
 # Set VM SecurityType and connect to DES
 $VirtualMachine = Set-AzVMOSDisk -VM $VirtualMachine -StorageAccountType "StandardSSD_LRS" -CreateOption "FromImage" -SecurityEncryptionType $secureEncryptGuestState -SecureVMDiskEncryptionSet $diskencset.Id;
-$VirtualMachine = Set-AzVmSecurityProfile -VM $VirtualMachine -SecurityType $vmSecurityType;
-$VirtualMachine = Set-AzVmUefi -VM $VirtualMachine -EnableVtpm $true -EnableSecureBoot $true;
+$VirtualMachine = Set-AzVMSecurityProfile -VM $VirtualMachine -SecurityType $vmSecurityType;
+$VirtualMachine = Set-AzVMUefi -VM $VirtualMachine -EnableVtpm $true -EnableSecureBoot $true;
 
-New-AzVM -ResourceGroupName $ResourceGroupName -Location $loc -Vm $VirtualMachine;
-$vm = Get-AzVm -ResourceGroupName $ResourceGroupName -Name $vmname;
+New-AzVM -ResourceGroupName $ResourceGroupName -Location $Location -Vm $VirtualMachine;
+$vm = Get-AzVM -ResourceGroupName $ResourceGroupName -Name $vmname;
 
 # Verify the SecurityEncryptionType value on the disk.
 # $vm.StorageProfile.OsDisk.ManagedDisk.SecurityProfile.SecurityEncryptionType == 'DiskWithVMGuestState';