Fix Azure Disk Encryption Error 0xc142506f Easily

️ Azure VM Disk Encryption Error: RUNTIME_E_KEYVAULT_SECRET_WRAP_WITH_KEK_FAILED (0xc142506f) – Why It Happens and How to Fix It

When setting up disk encryption for a Windows Server virtual machine (VM) in Azure, you might encounter a frustrating error that stops your progress cold:

The fault reason was: 0xc142506f — RUNTIME_E_KEYVAULT_SECRET_WRAP_WITH_KEK_FAILED
Key vault secret wrap with key encryption key failed.

This error typically pops up during the configuration of Azure Disk Encryption using customer-managed keys (CMK) stored in Azure Key Vault.

Why This Happens

The error message points to a failure in wrapping the secret with the Key Encryption Key (KEK). A common — and often overlooked — cause of this issue is using an RSA key with an insufficient key size.

By default, many users opt for 2048-bit RSA keys when creating a key in Azure Key Vault. While this size is technically secure, it’s not sufficient for all encryption operations in Azure — especially when encrypting Windows Server disks using Azure Disk Encryption.

✅ The Solution of 0xc142506f: Use a Larger Key Size

To resolve the issue, use a larger RSA key size — either 3072 or 4096 bits.

When creating a key in Azure Key Vault:

1. Select RSA as the key type.
2. Choose an RSA key size of 3072 or 4096.
3. Complete the rest of the key creation process.

Tip: Microsoft’s encryption policies may enforce stricter key size requirements for Windows VM disk encryption, especially in compliance-heavy environments.

Here’s what the correct configuration looks like when creating the key:

As shown above, ensure the RSA key size is set to 3072 or higher.

After Updating the Key

Once your new key is created with the correct key size:

1. Assign the necessary permissions for the Key Vault (get, wrapKey, unwrapKey).
2. Re-run the disk encryption process.
3. The error should no longer occur.

Final Thoughts

This is a classic example of how a small setting — like key size — can cause big headaches in cloud infrastructure. When dealing with encryption and key management in Azure, always verify the requirements for key size and type, especially for security-critical operations like VM disk encryption.

If you’re unsure, go with RSA 3072 by default — it offers a good balance between performance and compatibility.