diff --git a/docs-mslearn/toolkit/changelog.md b/docs-mslearn/toolkit/changelog.md index d1f201360..854ddb323 100644 --- a/docs-mslearn/toolkit/changelog.md +++ b/docs-mslearn/toolkit/changelog.md @@ -3,7 +3,7 @@ title: FinOps toolkit changelog description: Review the latest features and enhancements in the FinOps toolkit, including updates to FinOps hubs, Power BI reports, and more. author: MSBrett ms.author: brettwil -ms.date: 10/28/2026 +ms.date: 10/29/2026 ms.topic: reference ms.service: finops ms.subservice: finops-toolkit @@ -25,6 +25,11 @@ This article summarizes the features and enhancements in each release of the Fin The following section lists features and enhancements that are currently in development. +### [FinOps hubs](hubs/finops-hubs-overview.md) + +- **Added** + - Added Azure Data Explorer disk and double encryption options for FinOps hub deployments ([#2196](https://github.com/microsoft/finops-toolkit/issues/2196)). + -->
diff --git a/docs-mslearn/toolkit/hubs/template.md b/docs-mslearn/toolkit/hubs/template.md index 6baf717b2..58503dc8b 100644 --- a/docs-mslearn/toolkit/hubs/template.md +++ b/docs-mslearn/toolkit/hubs/template.md @@ -3,7 +3,7 @@ title: FinOps hub template description: Learn about what's included in the FinOps hub template including parameters, resources, and outputs. author: flanakin ms.author: micflan -ms.date: 10/28/2026 +ms.date: 10/29/2026 ms.topic: concept-article ms.service: finops ms.subservice: finops-toolkit @@ -85,6 +85,8 @@ Here are the parameters you can use to customize the deployment: | **location** | String | Optional. Azure location where all resources should be created. See . | Same as deployment | | **storageSku** | String | Optional. Storage SKU to use. LRS = Lowest cost, ZRS = High availability. Note Standard SKUs are not available for Data Lake gen2 storage. Allowed: `Premium_LRS`, `Premium_ZRS`. | "Premium_LRS" | | **dataExplorerName** | String | Optional. Name of the Azure Data Explorer cluster to use for advanced analytics. If empty, Azure Data Explorer will not be deployed. Required to use with Power BI if you have more than $2-5M/mo in costs being monitored. Default: "" (do not use). | | +| **enableDataExplorerDiskEncryption** | Bool | Optional. Enables disk encryption for the Azure Data Explorer cluster. Changing this setting on an existing cluster may cause temporary unavailability. | false | +| **enableDataExplorerDoubleEncryption** | Bool | Optional. Enables double encryption for the Azure Data Explorer cluster. Must be enabled when the cluster is created and cannot be changed afterward. | false | | **dataExplorerSkuName** | String | Optional. Name of the Azure Data Explorer SKU. Not all SKUs are available in every region. If deployment fails, see [common errors](../help/errors.md#the-sku-skuname-is-not-supported-in-region). Default: "Dev(No SLA)_Standard_D11_v2". | | | **dataExplorerSkuTier** | String | Optional. SKU tier for the Azure Data Explorer cluster. Use Basic for the lowest cost with no SLA (due to a single node). Use Standard for high availability and improved performance. Allowed values: Basic, Standard. Default: "Basic". | | | **dataExplorerSkuCapacity** | Int | Optional. Number of nodes to use in the cluster. Allowed values: 1 for the Basic SKU tier and 2-1000 for Standard. Default: 1. | | diff --git a/src/templates/finops-hub/createUiDefinition.json b/src/templates/finops-hub/createUiDefinition.json index 77ba01053..9c0066862 100644 --- a/src/templates/finops-hub/createUiDefinition.json +++ b/src/templates/finops-hub/createUiDefinition.json @@ -671,6 +671,20 @@ "text": "Configure data retention settings for Azure Data Explorer. When you redeploy or upgrade a hub, values left at the default keep the current retention settings and changed values are applied. To set a value back to the default, edit config/settings.json in the hub storage account or deploy with PowerShell." } }, + { + "name": "enableDataExplorerDiskEncryption", + "type": "Microsoft.Common.CheckBox", + "label": "Enable Data Explorer disk encryption", + "toolTip": "Enable disk encryption for the Azure Data Explorer cluster.", + "defaultValue": false + }, + { + "name": "enableDataExplorerDoubleEncryption", + "type": "Microsoft.Common.CheckBox", + "label": "Enable Data Explorer double encryption", + "toolTip": "Enable double encryption for the Azure Data Explorer cluster. This setting can only be enabled when the cluster is created.", + "defaultValue": false + }, { "name": "rawDays", "type": "Microsoft.Common.TextBox", @@ -1006,6 +1020,8 @@ "enableNatGateway": "[steps('advanced').networking.enableNatGateway]", "virtualNetworkAddressPrefix": "[steps('advanced').networking.virtualNetworkAddressPrefix]", "dataExplorerSku": "[steps('pricing').dataExplorer.dataExplorerSku]", + "enableDataExplorerDiskEncryption": "[steps('retention').dataExplorer.enableDataExplorerDiskEncryption]", + "enableDataExplorerDoubleEncryption": "[steps('retention').dataExplorer.enableDataExplorerDoubleEncryption]", "exportRetentionInDays": "[if(or(equals(steps('retention').storage.msexportsDays, ''), equals(steps('retention').storage.msexportsDays, '0')), parse('null'), steps('retention').storage.msexportsDays)]", "ingestionRetentionInMonths": "[if(or(equals(steps('retention').storage.ingestionMonths, ''), equals(steps('retention').storage.ingestionMonths, '13')), parse('null'), steps('retention').storage.ingestionMonths)]", "dataExplorerRawRetentionInDays": "[if(or(equals(steps('retention').dataExplorer.rawDays, ''), equals(steps('retention').dataExplorer.rawDays, '0')), parse('null'), steps('retention').dataExplorer.rawDays)]", diff --git a/src/templates/finops-hub/main.bicep b/src/templates/finops-hub/main.bicep index 03be52372..c94fec03d 100644 --- a/src/templates/finops-hub/main.bicep +++ b/src/templates/finops-hub/main.bicep @@ -51,6 +51,12 @@ param enableSpotRecommendations bool = false @description('Optional. Name of the Azure Data Explorer cluster to use for advanced analytics. If empty, Azure Data Explorer will not be deployed. Required to use with Power BI if you have more than $2-5M/mo in costs being monitored. Default: "" (do not use).') param dataExplorerName string = '' +@description('Optional. Enable disk encryption on the Azure Data Explorer cluster. Default: false.') +param enableDataExplorerDiskEncryption bool = false + +@description('Optional. Enable double encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.') +param enableDataExplorerDoubleEncryption bool = false + // https://learn.microsoft.com/azure/templates/microsoft.kusto/clusters?pivots=deployment-language-bicep#azuresku @description('Optional. Name of the Azure Data Explorer SKU. Default: "Dev(No SLA)_Standard_D11_v2".') @allowed([ @@ -184,6 +190,8 @@ module hub 'modules/hub.bicep' = { enableAHBRecommendations: enableAHBRecommendations enableSpotRecommendations: enableSpotRecommendations dataExplorerName: dataExplorerName + enableDataExplorerDiskEncryption: enableDataExplorerDiskEncryption + enableDataExplorerDoubleEncryption: enableDataExplorerDoubleEncryption dataExplorerSku: dataExplorerSku dataExplorerCapacity: dataExplorerCapacity fabricQueryUri: fabricQueryUri diff --git a/src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Analytics/app.bicep b/src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Analytics/app.bicep index 2ff7ae0df..f0c9041dc 100644 --- a/src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Analytics/app.bicep +++ b/src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Analytics/app.bicep @@ -28,6 +28,12 @@ param core CoreMetadata @maxLength(22) param clusterName string = '' +@description('Optional. Enable disk encryption on the Azure Data Explorer cluster. Default: false.') +param enableDataExplorerDiskEncryption bool = false + +@description('Optional. Enable double encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.') +param enableDataExplorerDoubleEncryption bool = false + // https://learn.microsoft.com/azure/templates/microsoft.kusto/clusters?pivots=deployment-language-bicep#azuresku @description('Optional. Name of the Azure Data Explorer SKU. Default: "Dev(No SLA)_Standard_E2a_v4".') @allowed([ @@ -142,6 +148,13 @@ var ftkReleaseUri = indexOf(finOpsToolkitVersion, '-dev') != -1 var useFabric = !empty(fabricQueryUri) var useAzure = !useFabric && !empty(clusterName) +var diskEncryptionProperties = !enableDataExplorerDiskEncryption ? {} : { + enableDiskEncryption: true +} +var doubleEncryptionProperties = !enableDataExplorerDoubleEncryption ? {} : { + enableDoubleEncryption: true +} + // cSpell:ignore ftkver, privatelink var dataExplorerDnsSuffixLookup = { AzureCloud: 'kusto.windows.net' @@ -306,6 +319,8 @@ resource cluster 'Microsoft.Kusto/clusters@2023-08-15' = if (useAzure) { } properties: { enableStreamingIngest: true + ...diskEncryptionProperties + ...doubleEncryptionProperties enableAutoStop: false publicNetworkAccess: app.hub.options.privateRouting ? 'Disabled' : 'Enabled' // TODO: Figure out why this is breaking upgrades diff --git a/src/templates/finops-hub/modules/hub.bicep b/src/templates/finops-hub/modules/hub.bicep index d829a0bed..9329bb5f6 100644 --- a/src/templates/finops-hub/modules/hub.bicep +++ b/src/templates/finops-hub/modules/hub.bicep @@ -68,6 +68,12 @@ param fabricCapacityUnits int = 2 @description('Optional. Name of the Azure Data Explorer cluster to use for advanced analytics. If empty, Azure Data Explorer will not be deployed. Required to use with Power BI if you have more than $2-5M/mo in costs being monitored. Default: "" (do not use).') param dataExplorerName string = '' +@description('Optional. Enable disk encryption on the Azure Data Explorer cluster. Default: false.') +param enableDataExplorerDiskEncryption bool = false + +@description('Optional. Enable double encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.') +param enableDataExplorerDoubleEncryption bool = false + // https://learn.microsoft.com/azure/templates/microsoft.kusto/clusters?pivots=deployment-language-bicep#azuresku @description('Optional. Name of the Azure Data Explorer SKU. Ignore when using Microsoft Fabric or not deploying Data Explorer. Default: "Dev(No SLA)_Standard_D11_v2".') @allowed([ @@ -307,6 +313,8 @@ module analytics 'Microsoft.FinOpsHubs/Analytics/app.bicep' = if (useFabric || u fabricQueryUri: fabricQueryUri fabricCapacityUnits: fabricCapacityUnits clusterName: dataExplorerName + enableDataExplorerDiskEncryption: enableDataExplorerDiskEncryption + enableDataExplorerDoubleEncryption: enableDataExplorerDoubleEncryption clusterSku: dataExplorerSku clusterCapacity: dataExplorerCapacity // Use the effective value from settings.json so a redeploy that omits the parameter keeps the current raw retention diff --git a/src/templates/finops-hub/test/main.test.bicep b/src/templates/finops-hub/test/main.test.bicep index 82d7595d9..d1d0362f0 100644 --- a/src/templates/finops-hub/test/main.test.bicep +++ b/src/templates/finops-hub/test/main.test.bicep @@ -15,4 +15,16 @@ module hub '../main.bicep' = { } } +// Test 2 - Creates a FinOps hub with Azure Data Explorer encryption enabled. +module hubWithAdxEncryption '../main.bicep' = { + name: 'finops-hub-adx-encryption' + params: { + hubName: '${uniqueName}-adx' + location: location + dataExplorerName: '${uniqueName}-adx' + enableDataExplorerDiskEncryption: true + enableDataExplorerDoubleEncryption: true + } +} + output hubName string = hub.outputs.name