Azure Data Explorer clusters should have disk encryption enabled
Enabling disk encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. The Azure Policy checks Microsoft.Kusto/Clusters for enableDiskEncryption. Checkov inspects `disk_encryption_enabled`.
Enabling disk encryption helps protect and safeguard your data to meet your organizational security and compliance commitments.
What this control checks
Azure Data Explorer clusters must have disk encryption enabled (enableDiskEncryption true).
Common pitfalls
Missing property also triggers the policy
The policy effect triggers when Microsoft.Kusto/clusters/enableDiskEncryption does not exist or equals false.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Disk encryption should be enabled on Azure Data Explorer" (f4b53539-8df9-40e4-86c6-6b607703bd4e); PowerPipe control azure_compliance.control.kusto_cluster_disk_encryption_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_74.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-28 (Protection of Information at Rest) and SC-28(1) (Cryptographic Protection).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-28 (Protection Of Information At Rest) and SC-28(1) (Cryptographic Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
FedRAMP Moderate Baseline Rev 4
- SC-28 (1): Cryptographic Protection
- SC-28(1) Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- 3.1.h Public Key Infrastructure (PKI)
- SC.L2-3.13.16 Protect the confidentiality of CUI at rest
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
Related controls
- Synapse workspaces should have data exfiltration protection enabled
- Storage accounts containing operational log containers should use customer-managed keys for encryption
- Service Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSign
- Key vaults should have deletion protection enabled
- Key vaults should have soft delete enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kusto_cluster_disk_encryption_enabled - Checkov Check:
CKV_AZURE_74 - Powerpipe Control:
azure_compliance.control.kusto_cluster_disk_encryption_enabled - Azure Policy Definition:
f4b53539-8df9-40e4-86c6-6b607703bd4e
Last reviewed: 2026-10-13