Encryption options for Azure IaaS VMs

Application level encryption – Use the application to encrypt its own data. For example SQL Transparent Data Encryption (TDE), Column Encryption using symmetric or asymmetric keys and AlwaysEncrypted to encrypt data at rest and in memory.

Custom application level encryption using Azure - Azure has a client-side encryption library that can be used to encrypt and decrypt data stored in Azure Storage.https://azure.microsoft.com/en-us/documentation/articles/storage-client-side-encryption/

Inside the OS file system encryption via BitLocker or DM-Crypt using Azure IaaS VM native encryption enabled through Azure Key Vault (and additional customer key (KEK) stored in Azure Key Vault can be used for additional encryption which is secured via Azure AD). Azure Key Vault uses industry leading HSM to safeguard the keys.https://azure.microsoft.com/en-us/documentation/articles/azure-security-disk-encryption/ 

Inside the OS file system encryption via 3rd party encryption solutions which may use Azure Key Vault or use a separate key store external from Azure. These solutions can use different encryption technologies but those listed utilize BitLocker for Windows. This has the potenetial benefit of separating the key from the lock in effect if a key vault other than Azure Key Vault is selected.http://www.cloudlinktech.com/choose-your-cloud/microsoft-azure/http://azure.trendmicro.com/ 

Storage Account level encryption at rest for automatic encryption and decryption. Here Azure stores and controls the keys.https://azure.microsoft.com/en-us/documentation/articles/storage-service-encryption/