XXX virtual machines should enable Azure Disk Encryption or EncryptionAtHost.

Worth taking a look at this, you may required to check compliance details, trigger a re‑evaluation, or confirm the policy definition version, learn.microsoft.com/en-us/azure/governance/policy/how-to/determine-non-compliance, learn.microsoft.com/en-us/answers/questions/2128903/disk-encryption-at-host-compliance-issue-on-window, learn.microsoft.com/en-us/answers/questions/1398951/ade-enabled-but-policy-still-showing-non-compliant