Azure Data Explorer clusters should use customer-managed keys for encryption at rest
Checks that Azure Data Explorer clusters use a customer-managed key for encryption at rest. This gives additional control over the key used for encryption at rest. It requires a Key Vault to manage the keys.
Enabling encryption at rest using a customer-managed key on your Azure Data Explorer cluster provides additional control over the key being used by the encryption at rest.
What this control checks
Checks whether Kusto cluster encryption at rest is set up with a customer-managed key (CMK)
Common pitfalls
Needs a Key Vault and suits special compliance cases
This feature is oftentimes applicable to customers with special compliance requirements. It requires a Key Vault for managing the keys.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Data Explorer encryption at rest should use a customer-managed key" (81e74cea-30fd-40d5-802f-d72103c2aaaa); PowerPipe control azure_compliance.control.kusto_cluster_encrypted_at_rest_with_cmk.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV2_AZURE_11.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-12 (Cryptographic Key Establishment and Management).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-12 (Cryptographic Key Establishment And Management).
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- 2.1.1.2.1 Ensure Critical Data is Encrypted with Customer Managed Keys (CMK)
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
kusto_cluster_encrypted_at_rest_with_cmk - Checkov Check:
CKV2_AZURE_11 - Powerpipe Control:
azure_compliance.control.kusto_cluster_encrypted_at_rest_with_cmk - Azure Policy Definition:
81e74cea-30fd-40d5-802f-d72103c2aaaa
Last reviewed: 2026-10-13