Azure Compliance ControlsAzure Data Explorer
Azure Data Explorer clusters should have disk encryption enabled
Enabling disk encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. The Azure Policy checks Microsoft.Kusto/Clusters for enableDiskEncryption. Checkov inspects `disk_encryption_enabled`.
What this control checks
Azure Data Explorer clusters must have disk encryption enabled (enableDiskEncryption true).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
FedRAMP Moderate Baseline Rev 4
- SC-28 (1): Cryptographic Protection
- SC-28(1) Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- 3.1.h Public Key Infrastructure (PKI)
- SC.L2-3.13.16 Protect the confidentiality of CUI at rest
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
Related controls
- Synapse workspaces should have data exfiltration protection enabled
- Storage accounts containing operational log containers should use customer-managed keys for encryption
- Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign
- Key vaults should have deletion protection enabled
- Key vaults should have soft delete enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kusto_cluster_disk_encryption_enabled - Checkov Check:
CKV_AZURE_74 - Powerpipe Control:
azure_compliance.control.kusto_cluster_disk_encryption_enabled - Azure Policy Definition:
f4b53539-8df9-40e4-86c6-6b607703bd4e
Last reviewed: 2026-10-13