In Azure, when you build Virtual Machines, you have the option to install Extensions, this may be AntiVirus etc. that you need to only license once you access your VM.
What you will notice is that once you do that, you have a few certificates installed on your VM called TenantEncryptionCert.
As shown below, my lab has just this on one server:
If you head over to the virtual machines section in Azure and click on the machine name and then navigate to the extensions section under Settings you will can see what is installed:
Now if I head over to my other server that doesn’t have any extensions installed when the VM was deployed in Azure you shouldn’t see the TenantEncryptionCert:
Now clicking the other server in the virtual machine section and clicking Extensions, you will notice nothing installed:
Hope it helps.