feat(finops-hub): add Azure Data Explorer encryption options

docs-mslearn/toolkit/changelog.md

@@ -3,7 +3,7 @@ title: FinOps toolkit changelog
 description: Review the latest features and enhancements in the FinOps toolkit, including updates to FinOps hubs, Power BI reports, and more.
 author: MSBrett
 ms.author: brettwil
-ms.date: 10/28/2026
+ms.date: 10/29/2026
 ms.topic: reference
 ms.service: finops
 ms.subservice: finops-toolkit
@@ -25,6 +25,11 @@ This article summarizes the features and enhancements in each release of the Fin
 
 The following section lists features and enhancements that are currently in development.
 
+### [FinOps hubs](hubs/finops-hubs-overview.md)
+
+- **Added**
+  - Added Azure Data Explorer disk and double encryption options for FinOps hub deployments ([#2196](https://github.com/microsoft/finops-toolkit/issues/2196)).
+
 -->
 
 <br><a name="latest"></a>

docs-mslearn/toolkit/hubs/template.md

@@ -3,7 +3,7 @@ title: FinOps hub template
 description: Learn about what's included in the FinOps hub template including parameters, resources, and outputs.
 author: flanakin
 ms.author: micflan
-ms.date: 10/28/2026
+ms.date: 10/29/2026
 ms.topic: concept-article
 ms.service: finops
 ms.subservice: finops-toolkit
@@ -85,6 +85,8 @@ Here are the parameters you can use to customize the deployment:
 | **location**                           | String | Optional. Azure location where all resources should be created. See <https://aka.ms/azureregions>.                                                                                                                                                                                                                                       | Same as deployment |
 | **storageSku**                         | String | Optional. Storage SKU to use. LRS = Lowest cost, ZRS = High availability. Note Standard SKUs are not available for Data Lake gen2 storage. Allowed: `Premium_LRS`, `Premium_ZRS`.                                                                                                                                                      | "Premium_LRS"      |
 | **dataExplorerName**                   | String | Optional. Name of the Azure Data Explorer cluster to use for advanced analytics. If empty, Azure Data Explorer will not be deployed. Required to use with Power BI if you have more than $2-5M/mo in costs being monitored. Default: "" (do not use).                                                                                  |                    |
+| **enableDataExplorerDiskEncryption** | Bool | Optional. Enables disk encryption for the Azure Data Explorer cluster. Changing this setting on an existing cluster may cause temporary unavailability. | false |
+| **enableDataExplorerDoubleEncryption** | Bool | Optional. Enables double encryption for the Azure Data Explorer cluster. Must be enabled when the cluster is created and cannot be changed afterward. | false |
 | **dataExplorerSkuName**                | String | Optional. Name of the Azure Data Explorer SKU. Not all SKUs are available in every region. If deployment fails, see [common errors](../help/errors.md#the-sku-skuname-is-not-supported-in-region). Default: "Dev(No SLA)_Standard_D11_v2".                                                                                                                                                                 |                    |
 | **dataExplorerSkuTier**                | String | Optional. SKU tier for the Azure Data Explorer cluster. Use Basic for the lowest cost with no SLA (due to a single node). Use Standard for high availability and improved performance. Allowed values: Basic, Standard. Default: "Basic".                                                                                              |                    |
 | **dataExplorerSkuCapacity**            | Int    | Optional. Number of nodes to use in the cluster. Allowed values: 1 for the Basic SKU tier and 2-1000 for Standard. Default: 1.                                                                                                                                                                                                         |                    |

src/templates/finops-hub/createUiDefinition.json

@@ -671,6 +671,20 @@
                   "text": "Configure data retention settings for Azure Data Explorer. When you redeploy or upgrade a hub, values left at the default keep the current retention settings and changed values are applied. To set a value back to the default, edit config/settings.json in the hub storage account or deploy with PowerShell."
                 }
               },
+              {
+                "name": "enableDataExplorerDiskEncryption",
+                "type": "Microsoft.Common.CheckBox",
+                "label": "Enable Data Explorer disk encryption",
+                "toolTip": "Enable disk encryption for the Azure Data Explorer cluster.",
+                "defaultValue": false
+              },
+              {
+                "name": "enableDataExplorerDoubleEncryption",
+                "type": "Microsoft.Common.CheckBox",
+                "label": "Enable Data Explorer double encryption",
+                "toolTip": "Enable double encryption for the Azure Data Explorer cluster. This setting can only be enabled when the cluster is created.",
+                "defaultValue": false
+              },
               {
                 "name": "rawDays",
                 "type": "Microsoft.Common.TextBox",
@@ -1006,6 +1020,8 @@
       "enableNatGateway": "[steps('advanced').networking.enableNatGateway]",
       "virtualNetworkAddressPrefix": "[steps('advanced').networking.virtualNetworkAddressPrefix]",
       "dataExplorerSku": "[steps('pricing').dataExplorer.dataExplorerSku]",
+      "enableDataExplorerDiskEncryption": "[steps('retention').dataExplorer.enableDataExplorerDiskEncryption]",
+      "enableDataExplorerDoubleEncryption": "[steps('retention').dataExplorer.enableDataExplorerDoubleEncryption]",
       "exportRetentionInDays": "[if(or(equals(steps('retention').storage.msexportsDays, ''), equals(steps('retention').storage.msexportsDays, '0')), parse('null'), steps('retention').storage.msexportsDays)]",
       "ingestionRetentionInMonths": "[if(or(equals(steps('retention').storage.ingestionMonths, ''), equals(steps('retention').storage.ingestionMonths, '13')), parse('null'), steps('retention').storage.ingestionMonths)]",
       "dataExplorerRawRetentionInDays": "[if(or(equals(steps('retention').dataExplorer.rawDays, ''), equals(steps('retention').dataExplorer.rawDays, '0')), parse('null'), steps('retention').dataExplorer.rawDays)]",

src/templates/finops-hub/main.bicep

@@ -51,6 +51,12 @@ param enableSpotRecommendations bool = false
 @description('Optional. Name of the Azure Data Explorer cluster to use for advanced analytics. If empty, Azure Data Explorer will not be deployed. Required to use with Power BI if you have more than $2-5M/mo in costs being monitored. Default: "" (do not use).')
 param dataExplorerName string = ''
 
+@description('Optional. Enable disk encryption on the Azure Data Explorer cluster. Default: false.')
+param enableDataExplorerDiskEncryption bool = false
+
+@description('Optional. Enable double encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.')
+param enableDataExplorerDoubleEncryption bool = false
+
 // https://learn.microsoft.com/azure/templates/microsoft.kusto/clusters?pivots=deployment-language-bicep#azuresku
 @description('Optional. Name of the Azure Data Explorer SKU. Default: "Dev(No SLA)_Standard_D11_v2".')
 @allowed([
@@ -184,6 +190,8 @@ module hub 'modules/hub.bicep' = {
     enableAHBRecommendations: enableAHBRecommendations
     enableSpotRecommendations: enableSpotRecommendations
     dataExplorerName: dataExplorerName
+    enableDataExplorerDiskEncryption: enableDataExplorerDiskEncryption
+    enableDataExplorerDoubleEncryption: enableDataExplorerDoubleEncryption
     dataExplorerSku: dataExplorerSku
     dataExplorerCapacity: dataExplorerCapacity
     fabricQueryUri: fabricQueryUri

src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Analytics/app.bicep

@@ -28,6 +28,12 @@ param core CoreMetadata
 @maxLength(22)
 param clusterName string = ''
 
+@description('Optional. Enable disk encryption on the Azure Data Explorer cluster. Default: false.')
+param enableDataExplorerDiskEncryption bool = false
+
+@description('Optional. Enable double encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.')
+param enableDataExplorerDoubleEncryption bool = false
+
 // https://learn.microsoft.com/azure/templates/microsoft.kusto/clusters?pivots=deployment-language-bicep#azuresku
 @description('Optional. Name of the Azure Data Explorer SKU. Default: "Dev(No SLA)_Standard_E2a_v4".')
 @allowed([
@@ -142,6 +148,13 @@ var ftkReleaseUri = indexOf(finOpsToolkitVersion, '-dev') != -1
 var useFabric = !empty(fabricQueryUri)
 var useAzure = !useFabric && !empty(clusterName)
 
+var diskEncryptionProperties = !enableDataExplorerDiskEncryption ? {} : {
+  enableDiskEncryption: true
+}
+var doubleEncryptionProperties = !enableDataExplorerDoubleEncryption ? {} : {
+  enableDoubleEncryption: true
+}
+
 // cSpell:ignore ftkver, privatelink
 var dataExplorerDnsSuffixLookup = {
   AzureCloud: 'kusto.windows.net'
@@ -306,6 +319,8 @@ resource cluster 'Microsoft.Kusto/clusters@2023-08-15' = if (useAzure) {
   }
   properties: {
     enableStreamingIngest: true
+    ...diskEncryptionProperties
+    ...doubleEncryptionProperties
     enableAutoStop: false
     publicNetworkAccess: app.hub.options.privateRouting ? 'Disabled' : 'Enabled'
     // TODO: Figure out why this is breaking upgrades

src/templates/finops-hub/modules/hub.bicep

@@ -68,6 +68,12 @@ param fabricCapacityUnits int = 2
 @description('Optional. Name of the Azure Data Explorer cluster to use for advanced analytics. If empty, Azure Data Explorer will not be deployed. Required to use with Power BI if you have more than $2-5M/mo in costs being monitored. Default: "" (do not use).')
 param dataExplorerName string = ''
 
+@description('Optional. Enable disk encryption on the Azure Data Explorer cluster. Default: false.')
+param enableDataExplorerDiskEncryption bool = false
+
+@description('Optional. Enable double encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.')
+param enableDataExplorerDoubleEncryption bool = false
+
 // https://learn.microsoft.com/azure/templates/microsoft.kusto/clusters?pivots=deployment-language-bicep#azuresku
 @description('Optional. Name of the Azure Data Explorer SKU. Ignore when using Microsoft Fabric or not deploying Data Explorer. Default: "Dev(No SLA)_Standard_D11_v2".')
 @allowed([
@@ -307,6 +313,8 @@ module analytics 'Microsoft.FinOpsHubs/Analytics/app.bicep' = if (useFabric || u
     fabricQueryUri: fabricQueryUri
     fabricCapacityUnits: fabricCapacityUnits
     clusterName: dataExplorerName
+    enableDataExplorerDiskEncryption: enableDataExplorerDiskEncryption
+    enableDataExplorerDoubleEncryption: enableDataExplorerDoubleEncryption
     clusterSku: dataExplorerSku
     clusterCapacity: dataExplorerCapacity
     // Use the effective value from settings.json so a redeploy that omits the parameter keeps the current raw retention

src/templates/finops-hub/test/main.test.bicep

@@ -15,4 +15,16 @@ module hub '../main.bicep' = {
   }
 }
 
+// Test 2 - Creates a FinOps hub with Azure Data Explorer encryption enabled.
+module hubWithAdxEncryption '../main.bicep' = {
+  name: 'finops-hub-adx-encryption'
+  params: {
+    hubName: '${uniqueName}-adx'
+    location: location
+    dataExplorerName: '${uniqueName}-adx'
+    enableDataExplorerDiskEncryption: true
+    enableDataExplorerDoubleEncryption: true
+  }
+}
+
 output hubName string = hub.outputs.name