Citrix Provisioning on Azure supports server-side encryption with customer-managed key
Citrix Provisioning on Azure is supporting customer-managed encryption keys to encrypt all managed disks, which are BDM Boot disk and WBC disk, associated with each target device. With this support, you can manage your organizational and compliance requirements by encrypting the managed disks of your machine catalog using your own encryption key. You can assign a Disk Encryption Set (DES) ID to the boot disk of the template VM. This DES is applied to all disks created when targets are provisioned using Citrix Virtual Apps and Desktops Setup Wizard.