Azure Stack Edge devices should have double encryption enabled
Azure Stack Edge devices should use double-encryption. Double encryption is the use of two layers of encryption: BitLocker XTS-AES 256-bit encryption on the data volumes and built-in encryption of the hard drives.
What this control checks
Azure Policy check b4ac1030-89c5-4697-8e00-28b5ba6a8811 looks at Microsoft.DataBoxEdge/DataBoxEdgeDevices and applies its effect when sku.name is notIn a list including TEA_1Node, TMA, EdgePR_Base and EdgeMR_Mini. Powerpipe check databox_edge_device_double_encryption_enabled reports ok when sku_name is in that list of SKUs, and alarm otherwise.
Framework mappings
The clauses this control is mapped to in each framework.
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
FedRAMP Moderate Baseline Rev 4
- SC-28 (1): Cryptographic Protection
- SC-28(1) Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- SC.L2-3.13.16 Protect the confidentiality of CUI at rest
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
databox_edge_device_double_encryption_enabled - Powerpipe Control:
azure_compliance.control.databox_edge_device_double_encryption_enabled - Azure Policy Definition:
b4ac1030-89c5-4697-8e00-28b5ba6a8811
Last reviewed: 2026-10-11