Azure Compliance ControlsAzure Data Explorer
Azure Data Explorer clusters should use customer-managed keys for encryption at rest
Checks that Azure Data Explorer clusters use a customer-managed key for encryption at rest. This gives additional control over the key used for encryption at rest. It requires a Key Vault to manage the keys.
What this control checks
Checks whether Kusto cluster encryption at rest is set up with a customer-managed key (CMK)
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kusto_cluster_encrypted_at_rest_with_cmk - Checkov Check:
CKV2_AZURE_11 - Powerpipe Control:
azure_compliance.control.kusto_cluster_encrypted_at_rest_with_cmk - Azure Policy Definition:
81e74cea-30fd-40d5-802f-d72103c2aaaa
Last reviewed: 2026-10-13