ADE/RHEL7: Cannot encrypt data disk

After creating a basic RHEL7 VM, I create a data disk and attach it to the VM.

> $ az vm encryption enable --resource-group redacted --name redacted --disk-encryption-keyvault redacted --encrypt-format-all --aad-client-id redacted --aad-client-secret redacted --volume-type=data
> Deployment failed. Correlation ID: redacted. VM has reported a failure when processing extension 'AzureDiskEncryptionForLinux'. Error message: "Enable failed.".

I have given my service principle full access to the keyvault in question. Investigating the logs yields the following.

> 2019/05/16 17:45:13 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 37038: [Info] trying to get the authorize uri from: Bearer authorization="redacted", resource="https://vault.azure.net"
>
> 2019/05/16 17:45:13 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 37038: [Info] 200 [('content-length', '1324'), ('expires', '-1'), ('x-content-type-options', 'nosniff'), ('set-cookie', 'fpc=redacted; expires=Sat, 15-Jun-2019 17:45:13 GMT; path=/; secure; HttpOnly, x-ms-gateway-slice=prod; path=/; secure; HttpOnly, stsservicecookie=ests; path=/; secure; HttpOnly'), ('x-ms-request-id', redacted'), ('strict-transport-security', 'max-age=31536000; includeSubDomains'), ('pragma', 'no-cache'), ('cache-control', 'no-cache, no-store'), ('date', 'Thu, 16 May 2019 17:45:13 GMT'), ('p3p', 'CP="DSP CUR OTPi IND OTRi ONL FIN"'), ('content-type', 'application/json; charset=utf-8')]
>
> 2019/05/16 17:45:13 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 37038: [Info] secret_keyvault_uri is: https://redacted/secrets/redacted and keyvault_uri is:https://redacted
>
> 2019/05/16 17:45:13 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 37038: [Info] 403 [('content-length', '56'), ('strict-transport-security', 'max-age=31536000;includeSubDomains'), ('x-content-type-options', 'nosniff'), ('x-aspnet-version', '4.0.30319'), ('x-ms-keyvault-region', 'canadaeast'), ('expires', '-1'), ('server', 'Microsoft-IIS/10.0'), ('x-ms-keyvault-service-version', '1.1.0.866'), ('pragma', 'no-cache'), ('cache-control', 'no-cache'), ('date', 'Thu, 16 May 2019 17:45:13 GMT'), ('x-ms-keyvault-network-info', 'addr=redacted;act_addr_fam=InterNetwork;'), ('x-powered-by', 'ASP.NET'), ('content-type', 'application/json; charset=utf-8'), ('x-ms-request-id', 'redacted')]
>
> 2019/05/16 17:45:13 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 37038: [Info] Failed to create_secret with error: 'id', stack trace: Traceback (most recent call last):
>
> 2019/05/16 17:45:13 File "/var/lib/waagent/Microsoft.Azure.Security.AzureDiskEncryptionForLinux-0.1.0.999336/main/KeyVaultUtil.py", line 228, in create_secret
>
> 2019/05/16 17:45:13 secret_id = result_json["id"]
>
> 2019/05/16 17:45:13 KeyError: 'id'
>
> 2019/05/16 17:45:13 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: 37038: [Info] archiving the encryption config file: /var/lib/azure_disk_encryption_config/azure_crypt_config.ini
>
> 2019/05/16 17:45:13 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: [StatusReport (2)] op: EnableEncryption
>
> 2019/05/16 17:45:13 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: [StatusReport (2)] status: error
>
> 2019/05/16 17:45:13 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: [StatusReport (2)] code: 13
>
> 2019/05/16 17:45:13 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: [StatusReport (2)] msg: Enable failed.
>
> 2019/05/16 17:45:13 [Microsoft.Azure.Security.AzureDiskEncryptionForLinux-1.0]: [StatusReport (2)] substatus: {"os": "NotEncrypted", "data": "NotMounted"}
>

Start with the AzureDiskEncryptionForLinux extension logs and inspect KeyVaultUtil.py, especially create_secret at line 228, alongside the reported 403 response. Reproduce the az vm encryption enable command on a RHEL7 VM with a data disk and trace how the Key Vault response is handled. Done means the data disk encryption operation completes instead of reporting Enable failed.

Written by the indexing model from the issue text.