diff --git a/pkg/apis/azureprovider/v1beta1/types.go b/pkg/apis/azureprovider/v1beta1/types.go
index a0d943ebf3c5..6859cac42290 100644
--- a/pkg/apis/azureprovider/v1beta1/types.go
+++ b/pkg/apis/azureprovider/v1beta1/types.go
@@ -401,11 +401,17 @@ type Image struct {
 type VMIdentity string
 
 type OSDisk struct {
-	OSType      string      `json:"osType"`
-	ManagedDisk ManagedDisk `json:"managedDisk"`
-	DiskSizeGB  int32       `json:"diskSizeGB"`
+	OSType      string                `json:"osType"`
+	ManagedDisk ManagedDiskParameters `json:"managedDisk"`
+	DiskSizeGB  int32                 `json:"diskSizeGB"`
 }
 
-type ManagedDisk struct {
-	StorageAccountType string `json:"storageAccountType"`
+type ManagedDiskParameters struct {
+	StorageAccountType string                       `json:"storageAccountType"`
+	DiskEncryptionSet  *DiskEncryptionSetParameters `json:"diskEncryptionSet,omitempty"`
+	ID                 string                       `json:"id,omitempty"`
+}
+
+type DiskEncryptionSetParameters struct {
+	ID string `json:"id,omitempty"`
 }
diff --git a/pkg/apis/azureprovider/v1beta1/zz_generated.deepcopy.go b/pkg/apis/azureprovider/v1beta1/zz_generated.deepcopy.go
index cfc2b4748bb9..4ec79391ec69 100644
--- a/pkg/apis/azureprovider/v1beta1/zz_generated.deepcopy.go
+++ b/pkg/apis/azureprovider/v1beta1/zz_generated.deepcopy.go
@@ -59,7 +59,7 @@ func (in *AzureMachineProviderSpec) DeepCopyInto(out *AzureMachineProviderSpec)
 		**out = **in
 	}
 	out.Image = in.Image
-	out.OSDisk = in.OSDisk
+	in.OSDisk.DeepCopyInto(&out.OSDisk)
 	if in.Tags != nil {
 		in, out := &in.Tags, &out.Tags
 		*out = make(map[string]string, len(*in))
@@ -188,6 +188,22 @@ func (in *BackendPool) DeepCopy() *BackendPool {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DiskEncryptionSetParameters) DeepCopyInto(out *DiskEncryptionSetParameters) {
+	*out = *in
+	return
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DiskEncryptionSetParameters.
+func (in *DiskEncryptionSetParameters) DeepCopy() *DiskEncryptionSetParameters {
+	if in == nil {
+		return nil
+	}
+	out := new(DiskEncryptionSetParameters)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *FrontendIPConfig) DeepCopyInto(out *FrontendIPConfig) {
 	*out = *in
@@ -333,17 +349,22 @@ func (in *LoadBalancerListener) DeepCopy() *LoadBalancerListener {
 }
 
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *ManagedDisk) DeepCopyInto(out *ManagedDisk) {
+func (in *ManagedDiskParameters) DeepCopyInto(out *ManagedDiskParameters) {
 	*out = *in
+	if in.DiskEncryptionSet != nil {
+		in, out := &in.DiskEncryptionSet, &out.DiskEncryptionSet
+		*out = new(DiskEncryptionSetParameters)
+		**out = **in
+	}
 	return
 }
 
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedDisk.
-func (in *ManagedDisk) DeepCopy() *ManagedDisk {
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedDiskParameters.
+func (in *ManagedDiskParameters) DeepCopy() *ManagedDiskParameters {
 	if in == nil {
 		return nil
 	}
-	out := new(ManagedDisk)
+	out := new(ManagedDiskParameters)
 	in.DeepCopyInto(out)
 	return out
 }
@@ -384,7 +405,7 @@ func (in *Network) DeepCopy() *Network {
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *OSDisk) DeepCopyInto(out *OSDisk) {
 	*out = *in
-	out.ManagedDisk = in.ManagedDisk
+	in.ManagedDisk.DeepCopyInto(&out.ManagedDisk)
 	return
 }
 
@@ -509,7 +530,7 @@ func (in Subnets) DeepCopy() Subnets {
 func (in *VM) DeepCopyInto(out *VM) {
 	*out = *in
 	out.Image = in.Image
-	out.OSDisk = in.OSDisk
+	in.OSDisk.DeepCopyInto(&out.OSDisk)
 	return
 }
 
diff --git a/pkg/cloud/azure/actuators/machine/stubs.go b/pkg/cloud/azure/actuators/machine/stubs.go
index 26e5bef8805b..4c9fe7dc2139 100644
--- a/pkg/cloud/azure/actuators/machine/stubs.go
+++ b/pkg/cloud/azure/actuators/machine/stubs.go
@@ -39,7 +39,7 @@ func stubProviderConfig() *providerspecv1.AzureMachineProviderSpec {
 		Location:             "eastus2",
 		VMSize:               "Standard_B2ms",
 		Image:                providerspecv1.Image{ResourceID: "/resourceGroups/os4-common/providers/Microsoft.Compute/images/test1-controlplane-0-image-20190529150403"},
-		OSDisk:               providerspecv1.OSDisk{OSType: "Linux", ManagedDisk: providerspecv1.ManagedDisk{StorageAccountType: "Premium_LRS"}, DiskSizeGB: 60},
+		OSDisk:               providerspecv1.OSDisk{OSType: "Linux", ManagedDisk: providerspecv1.ManagedDiskParameters{StorageAccountType: "Premium_LRS"}, DiskSizeGB: 60},
 		SSHPublicKey:         "c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCQVFDNEd4SGQ1L0pLZVJYMGZOMCt4YzM1eXhLdmtvb0Qwb0l2RnNCdDNHNTNaSXZlTWxwNUppQTRWT0Y3YjJ4cHZmL1FHbVpmWWl4d1JYMHdUKzRWUzYxV1ZNeUdZRUhPcE9QYy85MWZTcTg4bTJZbitBYVhTUUxTbFpaVkZJTDZsK296bjlRQ3NaSXhqSlpkTW5BTlRQdlhWMWpjSVNJeDhmU0pKeWVEdlhFU2FEQ2N1VjdPZTdvd01lVVpseCtUUEhkcU85eEV1OXFuREVYUXo1SUVQQUMwTElSQnVicmJVaTRQZUJFUlFieVBQd1p0Um9NN2pFZ3RuRFhDcmxYbXo2T0N3NXNiaE1FNEJCUVliVjBOV0J3Unl2bHJReDJtYzZHNnJjODJ6OWxJMkRKQ3ZJcnNkRW43NytQZThiWm1MVU83V0sxRUFyd2xXY0FiZU1kYUFkbzcgamNoYWxvdXBAZGhjcC0yNC0xNzAuYnJxLnJlZGhhdC5jb20K",
 		PublicIP:             false,
 		Subnet:               "stub-machine-subnet",
diff --git a/pkg/cloud/azure/services/virtualmachines/virtualmachines.go b/pkg/cloud/azure/services/virtualmachines/virtualmachines.go
index 7378cb2fe7e9..91aca80858c8 100644
--- a/pkg/cloud/azure/services/virtualmachines/virtualmachines.go
+++ b/pkg/cloud/azure/services/virtualmachines/virtualmachines.go
@@ -189,6 +189,10 @@ func (s *Service) CreateOrUpdate(ctx context.Context, spec azure.Spec) error {
 		}
 	}
 
+	if vmSpec.OSDisk.ManagedDisk.DiskEncryptionSet != nil {
+		virtualMachine.StorageProfile.OsDisk.ManagedDisk.DiskEncryptionSet = &compute.DiskEncryptionSetParameters{ID: to.StringPtr(vmSpec.OSDisk.ManagedDisk.DiskEncryptionSet.ID)}
+	}
+
 	if vmSpec.Zone != "" {
 		zones := []string{vmSpec.Zone}
 		virtualMachine.Zones = &zones