There is a command group 'az_vmss_encryption'. This group of commands could 'manage encryption of vmss'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_vmss_encryption_enable'.The syntax is: az vmss encryption enable --disk-encryption-keyvault
                          [--force]
                          [--ids]
                          [--key-encryption-algorithm]
                          [--key-encryption-key]
                          [--key-encryption-keyvault]
                          [--name]
                          [--resource-group]
                          [--subscription]
                          [--volume-type {all, data, os}]. The 1th example of the child command would be to use it to 'encrypt a vm scale set using a key vault in the same resource group', the syntax is: az vmss encryption enable -g MyResourceGroup -n MyVmss --disk-encryption-keyvault MyVault. The 2th example of the child command would be to use it to 'encrypt a vmss with managed disks   autogenerated', the syntax is: az vmss encryption enable --disk-encryption-keyvault MyVault --name MyVmss --resource-group MyResourceGroup --volume-type DATA. The parameter '--disk-encryption-keyvault' is required. It is used to name or id of the key vault where the generated encryption key will be placed.. The parameter '--force' is optional. continue by ignoring client side validation errors.. The parameter '--ids' is optional. one or more resource ids (space-delimited). it should be a complete resource id containing all information of 'resource id' arguments. you should provide either --ids or other 'resource id' arguments.. 