diff --git a/azurerm/internal/tf/base64/schema.go b/azurerm/internal/tf/base64/schema.go
index 5b6d65d73817..c95611a2f566 100644
--- a/azurerm/internal/tf/base64/schema.go
+++ b/azurerm/internal/tf/base64/schema.go
@@ -13,6 +13,7 @@ func OptionalSchema(isVirtualMachine bool) *schema.Schema {
 		Type:         schema.TypeString,
 		Optional:     true,
 		ForceNew:     isVirtualMachine,
+		Sensitive:    true,
 		ValidateFunc: validation.StringIsBase64,
 	}
 }