Azure Data Explorer clusters should have double encryption enabled
Checks that double encryption is enabled on Azure Data Explorer clusters. When enabled, data in the storage account is encrypted twice, once at the service level and once at the infrastructure level, using two different algorithms and two different keys.
Enabling double encryption helps protect and safeguard your data to meet your organizational security and compliance commitments.
What this control checks
Checks the double encryption setting on Azure Data Explorer (kusto) clusters
Common pitfalls
Unset enableDoubleEncryption also fails the check
The policy flags Microsoft.Kusto/Clusters when Microsoft.Kusto/clusters/enableDoubleEncryption does not exist or equals false.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Double encryption should be enabled on Azure Data Explorer" (ec068d99-e9c7-401f-8cef-5bdde4e6ccf1); PowerPipe control azure_compliance.control.kusto_cluster_double_encryption_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_75.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-28 (Protection of Information at Rest) and SC-28(1) (Cryptographic Protection).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-28 (Protection Of Information At Rest) and SC-28(1) (Cryptographic Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
FedRAMP Moderate Baseline Rev 4
- SC-28 (1): Cryptographic Protection
- SC-28(1) Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- SC.L2-3.13.16 Protect the confidentiality of CUI at rest
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kusto_cluster_double_encryption_enabled - Checkov Check:
CKV_AZURE_75 - Powerpipe Control:
azure_compliance.control.kusto_cluster_double_encryption_enabled - Azure Policy Definition:
ec068d99-e9c7-401f-8cef-5bdde4e6ccf1
Last reviewed: 2026-10-13