The property "EncryptionAtHost" cannot be found on this object

Looking for a workaround that doesn't involve just manually changing all of the VMs.

You can use the PowerShell script below to check all the recommended steps to enable EncryptionAtHost for all the VMs in the subscription. It will create an Excel file listing any failures to update, along with error details, so you can easily identify non-compliant VMs without manual effort.

The script will check the below configurations

• Registers EncryptionAtHost if needed
• Enables EncryptionAtHostonly if not already enabled
• Starts the VM if it’s deallocated — even when encryption is already enabled.
• Tracks failures with encryption state
  Exports a CSV report only if there are any failures

Here is the updated Powershell script

$subscriptionID = "your-subscription-id"
Set-AzContext -SubscriptionId $subscriptionID

$failures = @()

$feature = Get-AzProviderFeature -ProviderNamespace "Microsoft.Compute" -FeatureName "EncryptionAtHost"
if ($feature.RegistrationState -ne "Registered") {
    Write-Host "EncryptionAtHost is not registered. Registering now..." -ForegroundColor Yellow
    Register-AzProviderFeature -ProviderNamespace "Microsoft.Compute" -FeatureName "EncryptionAtHost"

    do {
        Start-Sleep -Seconds 15
        $feature = Get-AzProviderFeature -ProviderNamespace "Microsoft.Compute" -FeatureName "EncryptionAtHost"
        Write-Host "Waiting for registration... Current state: $($feature.RegistrationState)"
    } while ($feature.RegistrationState -ne "Registered")

    Register-AzResourceProvider -ProviderNamespace "Microsoft.Compute"
    Write-Host "EncryptionAtHost feature is now registered and ready." -ForegroundColor Green
} else {
    Write-Host "EncryptionAtHost is already registered. Proceeding..." -ForegroundColor Green
}

# List of VMs
$subVMs = @(
    "Venkat-Vm"
)

$resourceGroup = "VENKAT-RG"

foreach ($vmName in $subVMs) {
    try {
        Write-Host "`n🔄 Checking VM: ${vmName}..." -ForegroundColor Cyan

        $statusVm = Get-AzVM -ResourceGroupName $resourceGroup -Name $vmName -Status
        if (-not $statusVm -or -not $statusVm.Statuses) {
            throw "VM '$vmName' not found or 'Statuses' not available."
        }

        $resourceGroup = $statusVm.ResourceGroupName
        $powerState = ($statusVm.Statuses | Where-Object { $_.Code -like "PowerState/*" }).DisplayStatus
        $vm = Get-AzVM -ResourceGroupName $resourceGroup -Name $vmName -ErrorAction Stop

        $existingEncryption = if ($vm.SecurityProfile) { $vm.SecurityProfile.EncryptionAtHost } else { $false }

        if ($existingEncryption -eq $true) {
            Write-Host "Already encrypted: $vmName" -ForegroundColor Green

            if ($powerState.Trim().ToLower() -eq "vm deallocated") {
                Write-Host "Starting previously deallocated VM: $vmName"
                Start-AzVM -ResourceGroupName $resourceGroup -Name $vmName -ErrorAction Stop
            }

            continue
        }

        if ($powerState.Trim().ToLower() -ne "vm deallocated") {
            Write-Host "Stopping VM: $vmName"
            Stop-AzVM -ResourceGroupName $resourceGroup -Name $vmName -Force -ErrorAction Stop

            do {
                Start-Sleep -Seconds 10
                $vmState = (Get-AzVM -ResourceGroupName $resourceGroup -Name $vmName -Status).Statuses |
                           Where-Object { $_.Code -like "PowerState/*" } |
                           Select-Object -ExpandProperty DisplayStatus
                Write-Host "Current state: $vmState"
            } while ($vmState.Trim().ToLower() -ne "vm deallocated")
        }

        $vm = Get-AzVM -ResourceGroupName $resourceGroup -Name $vmName -ErrorAction Stop

        if (-not $vm.SecurityProfile) {
            $vm.SecurityProfile = New-Object -TypeName Microsoft.Azure.Management.Compute.Models.SecurityProfile
        }

        $vm.SecurityProfile.EncryptionAtHost = $true
        Write-Host "Enabling EncryptionAtHost on $vmName"
        Update-AzVM -ResourceGroupName $resourceGroup -VM $vm -ErrorAction Stop

        Write-Host "Encryption enabled on $vmName" -ForegroundColor Green
        Start-AzVM -ResourceGroupName $resourceGroup -Name $vmName -ErrorAction Stop
    }

    catch {
        try {
            $vmTry = Get-AzVM -ResourceGroupName $resourceGroup -Name $vmName -Status -ErrorAction Stop
            $encryptionState = if ($vmTry.SecurityProfile) { $vmTry.SecurityProfile.EncryptionAtHost } else { "NotSet" }
            $rg = $vmTry.ResourceGroupName
        }
        catch {
            $encryptionState = "Unknown"
            $rg = "Unknown"
        }

        Write-Host " Failed: $vmName - $($_.Exception.Message)" -ForegroundColor Red

        $failures += [PSCustomObject]@{
            VMName                  = $vmName
            ResourceGroup           = $rg
            CurrentEncryptionAtHost = $encryptionState
            ErrorMessage            = $_.Exception.Message
        }
    }
}


if ($failures.Count -gt 0) {
    $failures | Export-Csv -Path "./encryptionAtHostFailures.csv" -NoTypeInformation
    Write-Host "Exported failed VM details to encryptionAtHostFailures.csv" -ForegroundColor Cyan
} else {
    Write-Host "All VMs processed successfully." -ForegroundColor Green
}

Output: