Use disk encryption for Azure Data Explorer clusters

March 21, 2025 ยท View on GitHub

SYNOPSIS

Use disk encryption for Azure Data Explorer (ADX) clusters.

DESCRIPTION

Azure storage is encrypted at rest, however computing resources can additionally use disk encryption. Disk encryption provides additional security for data at rest.

RECOMMENDATION

Consider enabling disk encryption on Azure Data Explorer clusters.

EXAMPLES

Configure with Azure template

To deploy clusters that pass this rule:

  • Set properties.enableDiskEncryption to true.

For example:

{
    "type": "Microsoft.Kusto/clusters",
    "apiVersion": "2021-08-27",
    "name": "[parameters('name')]",
    "location": "[parameters('location')]",
    "sku": {
        "name": "Standard_D11_v2",
        "tier": "Standard"
    },
    "identity": {
        "type": "SystemAssigned"
    },
    "properties": {
        "enableDiskEncryption": true
    }
}

Configure with Bicep

To deploy clusters that pass this rule:

  • Set properties.enableDiskEncryption to true.

For example:

resource adx 'Microsoft.Kusto/clusters@2021-08-27' = {
  name: name
  location: location
  sku: {
    name: 'Standard_D11_v2'
    tier: 'Standard'
  }
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    enableDiskEncryption: true
  }
}