From 0b22f9e348b53a9cc332d7ab370e5fd7cdc533c6 Mon Sep 17 00:00:00 2001 From: Chaithanya Nallamothu Date: Mon, 5 Oct 2026 23:06:56 +0200 Subject: [PATCH 1/4] feat(finops-hub): add ADX encryption options --- src/templates/finops-hub/main.bicep | 8 ++++++++ .../modules/Microsoft.FinOpsHubs/Analytics/app.bicep | 8 ++++++++ src/templates/finops-hub/modules/hub.bicep | 8 ++++++++ src/templates/finops-hub/test/main.test.bicep | 12 ++++++++++++ 4 files changed, 36 insertions(+) diff --git a/src/templates/finops-hub/main.bicep b/src/templates/finops-hub/main.bicep index d5b3a8850..5ae523c94 100644 --- a/src/templates/finops-hub/main.bicep +++ b/src/templates/finops-hub/main.bicep @@ -51,6 +51,12 @@ param enableSpotRecommendations bool = false @description('Optional. Name of the Azure Data Explorer cluster to use for advanced analytics. If empty, Azure Data Explorer will not be deployed. Required to use with Power BI if you have more than $2-5M/mo in costs being monitored. Default: "" (do not use).') param dataExplorerName string = '' +@description('Optional. Enable disk encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.') +param enableAdxDiskEncryption bool = false + +@description('Optional. Enable double encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.') +param enableAdxDoubleEncryption bool = false + // https://learn.microsoft.com/azure/templates/microsoft.kusto/clusters?pivots=deployment-language-bicep#azuresku @description('Optional. Name of the Azure Data Explorer SKU. Default: "Dev(No SLA)_Standard_D11_v2".') @allowed([ @@ -184,6 +190,8 @@ module hub 'modules/hub.bicep' = { enableAHBRecommendations: enableAHBRecommendations enableSpotRecommendations: enableSpotRecommendations dataExplorerName: dataExplorerName + enableAdxDiskEncryption: enableAdxDiskEncryption + enableAdxDoubleEncryption: enableAdxDoubleEncryption dataExplorerSku: dataExplorerSku dataExplorerCapacity: dataExplorerCapacity fabricQueryUri: fabricQueryUri diff --git a/src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Analytics/app.bicep b/src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Analytics/app.bicep index 84a29d95c..09862bdc0 100644 --- a/src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Analytics/app.bicep +++ b/src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Analytics/app.bicep @@ -28,6 +28,12 @@ param core CoreMetadata @maxLength(22) param clusterName string = '' +@description('Optional. Enable disk encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.') +param enableAdxDiskEncryption bool = false + +@description('Optional. Enable double encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.') +param enableAdxDoubleEncryption bool = false + // https://learn.microsoft.com/azure/templates/microsoft.kusto/clusters?pivots=deployment-language-bicep#azuresku @description('Optional. Name of the Azure Data Explorer SKU. Default: "Dev(No SLA)_Standard_E2a_v4".') @allowed([ @@ -306,6 +312,8 @@ resource cluster 'Microsoft.Kusto/clusters@2023-08-15' = if (useAzure) { } properties: { enableStreamingIngest: true + enableDiskEncryption: enableAdxDiskEncryption + enableDoubleEncryption: enableAdxDoubleEncryption enableAutoStop: false publicNetworkAccess: app.hub.options.privateRouting ? 'Disabled' : 'Enabled' // TODO: Figure out why this is breaking upgrades diff --git a/src/templates/finops-hub/modules/hub.bicep b/src/templates/finops-hub/modules/hub.bicep index c5a563d63..d1062abc3 100644 --- a/src/templates/finops-hub/modules/hub.bicep +++ b/src/templates/finops-hub/modules/hub.bicep @@ -68,6 +68,12 @@ param fabricCapacityUnits int = 2 @description('Optional. Name of the Azure Data Explorer cluster to use for advanced analytics. If empty, Azure Data Explorer will not be deployed. Required to use with Power BI if you have more than $2-5M/mo in costs being monitored. Default: "" (do not use).') param dataExplorerName string = '' +@description('Optional. Enable disk encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.') +param enableAdxDiskEncryption bool = false + +@description('Optional. Enable double encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.') +param enableAdxDoubleEncryption bool = false + // https://learn.microsoft.com/azure/templates/microsoft.kusto/clusters?pivots=deployment-language-bicep#azuresku @description('Optional. Name of the Azure Data Explorer SKU. Ignore when using Microsoft Fabric or not deploying Data Explorer. Default: "Dev(No SLA)_Standard_D11_v2".') @allowed([ @@ -307,6 +313,8 @@ module analytics 'Microsoft.FinOpsHubs/Analytics/app.bicep' = if (useFabric || u fabricQueryUri: fabricQueryUri fabricCapacityUnits: fabricCapacityUnits clusterName: dataExplorerName + enableAdxDiskEncryption: enableAdxDiskEncryption + enableAdxDoubleEncryption: enableAdxDoubleEncryption clusterSku: dataExplorerSku clusterCapacity: dataExplorerCapacity rawRetentionInDays: dataExplorerRawRetentionInDays diff --git a/src/templates/finops-hub/test/main.test.bicep b/src/templates/finops-hub/test/main.test.bicep index 82d7595d9..3d4ca2693 100644 --- a/src/templates/finops-hub/test/main.test.bicep +++ b/src/templates/finops-hub/test/main.test.bicep @@ -15,4 +15,16 @@ module hub '../main.bicep' = { } } +// Test 2 - Creates a FinOps hub with Azure Data Explorer encryption enabled. +module hubWithAdxEncryption '../main.bicep' = { + name: 'finops-hub-adx-encryption' + params: { + hubName: '${uniqueName}-adx' + location: location + dataExplorerName: '${uniqueName}-adx' + enableAdxDiskEncryption: true + enableAdxDoubleEncryption: true + } +} + output hubName string = hub.outputs.name From 62fc5b78ef2170a6b97c17d55ad3442b3ccf7619 Mon Sep 17 00:00:00 2001 From: Chaithanya Nallamothu Date: Mon, 5 Oct 2026 23:16:07 +0200 Subject: [PATCH 2/4] docs: update FinOps Hub changelog --- docs-mslearn/toolkit/changelog.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs-mslearn/toolkit/changelog.md b/docs-mslearn/toolkit/changelog.md index 6ca4dd7c3..1e0808763 100644 --- a/docs-mslearn/toolkit/changelog.md +++ b/docs-mslearn/toolkit/changelog.md @@ -29,6 +29,7 @@ The following section lists features and enhancements that are currently in deve - **Added** - Added VNet and private network modes, including opt-in NAT Gateway support for private mode; NAT Gateway incurs additional cost when enabled ([#2163](https://github.com/microsoft/finops-toolkit/pull/2163)). + - Added Azure Data Explorer disk and double encryption options for FinOps hub deployments ([#2196](https://github.com/microsoft/finops-toolkit/issues/2196)). - **Changed** - Clarified that the FinOps toolkit exclusively manages the FinOps hub virtual network and documented customer-managed private endpoints as the preferred private-access topology, with virtual network peering as a secondary option ([#2156](https://github.com/microsoft/finops-toolkit/issues/2156)). - Replaced redundant `tolower()` comparisons in hub KQL with case-insensitive operators (`has`, `=~`, `!~`) so the engine can use the term index instead of scanning every row ([#2213](https://github.com/microsoft/finops-toolkit/issues/2213)). From f12bf19c5c097d273fa60bedfcd1cbc339cf450f Mon Sep 17 00:00:00 2001 From: Chaithanya Nallamothu Date: Wed, 7 Oct 2026 20:39:14 +0200 Subject: [PATCH 3/4] Address ADX encryption review feedback Signed-off-by: Chaithanya Nallamothu --- docs-mslearn/toolkit/changelog.md | 2 +- src/templates/finops-hub/createUiDefinition.json | 16 ++++++++++++++++ .../Microsoft.FinOpsHubs/Analytics/app.bicep | 11 +++++++++-- 3 files changed, 26 insertions(+), 3 deletions(-) diff --git a/docs-mslearn/toolkit/changelog.md b/docs-mslearn/toolkit/changelog.md index 1e0808763..783311a07 100644 --- a/docs-mslearn/toolkit/changelog.md +++ b/docs-mslearn/toolkit/changelog.md @@ -3,7 +3,7 @@ title: FinOps toolkit changelog description: Review the latest features and enhancements in the FinOps toolkit, including updates to FinOps hubs, Power BI reports, and more. author: MSBrett ms.author: brettwil -ms.date: 09/11/2026 +ms.date: 10/07/2026 ms.topic: reference ms.service: finops ms.subservice: finops-toolkit diff --git a/src/templates/finops-hub/createUiDefinition.json b/src/templates/finops-hub/createUiDefinition.json index 27c8de8dc..8bd74c2ab 100644 --- a/src/templates/finops-hub/createUiDefinition.json +++ b/src/templates/finops-hub/createUiDefinition.json @@ -671,6 +671,20 @@ "text": "Configure data retention settings for Azure Data Explorer." } }, + { + "name": "enableAdxDiskEncryption", + "type": "Microsoft.Common.CheckBox", + "label": "Enable Data Explorer disk encryption", + "toolTip": "Enable disk encryption for the Azure Data Explorer cluster. This setting can only be enabled when the cluster is created.", + "defaultValue": false + }, + { + "name": "enableAdxDoubleEncryption", + "type": "Microsoft.Common.CheckBox", + "label": "Enable Data Explorer double encryption", + "toolTip": "Enable double encryption for the Azure Data Explorer cluster. This setting can only be enabled when the cluster is created.", + "defaultValue": false + }, { "name": "rawDays", "type": "Microsoft.Common.TextBox", @@ -1006,6 +1020,8 @@ "enableNatGateway": "[steps('advanced').networking.enableNatGateway]", "virtualNetworkAddressPrefix": "[steps('advanced').networking.virtualNetworkAddressPrefix]", "dataExplorerSku": "[steps('pricing').dataExplorer.dataExplorerSku]", + "enableAdxDiskEncryption": "[steps('retention').dataExplorer.enableAdxDiskEncryption]", + "enableAdxDoubleEncryption": "[steps('retention').dataExplorer.enableAdxDoubleEncryption]", "exportRetentionInDays": "[steps('retention').storage.msexportsDays]", "ingestionRetentionInMonths": "[steps('retention').storage.ingestionMonths]", "dataExplorerRawRetentionInDays": "[steps('retention').dataExplorer.rawDays]", diff --git a/src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Analytics/app.bicep b/src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Analytics/app.bicep index 09862bdc0..75c018e15 100644 --- a/src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Analytics/app.bicep +++ b/src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Analytics/app.bicep @@ -148,6 +148,13 @@ var ftkReleaseUri = indexOf(finOpsToolkitVersion, '-dev') != -1 var useFabric = !empty(fabricQueryUri) var useAzure = !useFabric && !empty(clusterName) +var diskEncryptionProperties = !enableAdxDiskEncryption ? {} : { + enableDiskEncryption: true +} +var doubleEncryptionProperties = !enableAdxDoubleEncryption ? {} : { + enableDoubleEncryption: true +} + // cSpell:ignore ftkver, privatelink var dataExplorerDnsSuffixLookup = { AzureCloud: 'kusto.windows.net' @@ -312,8 +319,8 @@ resource cluster 'Microsoft.Kusto/clusters@2023-08-15' = if (useAzure) { } properties: { enableStreamingIngest: true - enableDiskEncryption: enableAdxDiskEncryption - enableDoubleEncryption: enableAdxDoubleEncryption + ...diskEncryptionProperties + ...doubleEncryptionProperties enableAutoStop: false publicNetworkAccess: app.hub.options.privateRouting ? 'Disabled' : 'Enabled' // TODO: Figure out why this is breaking upgrades From 96bb05817bac52552943771ca3f3294aacdf7dc2 Mon Sep 17 00:00:00 2001 From: Chaithanya Nallamothu Date: Wed, 7 Oct 2026 20:51:35 +0200 Subject: [PATCH 4/4] Align Data Explorer encryption parameters Signed-off-by: Chaithanya Nallamothu --- src/templates/finops-hub/createUiDefinition.json | 10 +++++----- src/templates/finops-hub/main.bicep | 10 +++++----- .../modules/Microsoft.FinOpsHubs/Analytics/app.bicep | 10 +++++----- src/templates/finops-hub/modules/hub.bicep | 10 +++++----- src/templates/finops-hub/test/main.test.bicep | 4 ++-- 5 files changed, 22 insertions(+), 22 deletions(-) diff --git a/src/templates/finops-hub/createUiDefinition.json b/src/templates/finops-hub/createUiDefinition.json index 8bd74c2ab..66a40c67e 100644 --- a/src/templates/finops-hub/createUiDefinition.json +++ b/src/templates/finops-hub/createUiDefinition.json @@ -672,14 +672,14 @@ } }, { - "name": "enableAdxDiskEncryption", + "name": "enableDataExplorerDiskEncryption", "type": "Microsoft.Common.CheckBox", "label": "Enable Data Explorer disk encryption", - "toolTip": "Enable disk encryption for the Azure Data Explorer cluster. This setting can only be enabled when the cluster is created.", + "toolTip": "Enable disk encryption for the Azure Data Explorer cluster.", "defaultValue": false }, { - "name": "enableAdxDoubleEncryption", + "name": "enableDataExplorerDoubleEncryption", "type": "Microsoft.Common.CheckBox", "label": "Enable Data Explorer double encryption", "toolTip": "Enable double encryption for the Azure Data Explorer cluster. This setting can only be enabled when the cluster is created.", @@ -1020,8 +1020,8 @@ "enableNatGateway": "[steps('advanced').networking.enableNatGateway]", "virtualNetworkAddressPrefix": "[steps('advanced').networking.virtualNetworkAddressPrefix]", "dataExplorerSku": "[steps('pricing').dataExplorer.dataExplorerSku]", - "enableAdxDiskEncryption": "[steps('retention').dataExplorer.enableAdxDiskEncryption]", - "enableAdxDoubleEncryption": "[steps('retention').dataExplorer.enableAdxDoubleEncryption]", + "enableDataExplorerDiskEncryption": "[steps('retention').dataExplorer.enableDataExplorerDiskEncryption]", + "enableDataExplorerDoubleEncryption": "[steps('retention').dataExplorer.enableDataExplorerDoubleEncryption]", "exportRetentionInDays": "[steps('retention').storage.msexportsDays]", "ingestionRetentionInMonths": "[steps('retention').storage.ingestionMonths]", "dataExplorerRawRetentionInDays": "[steps('retention').dataExplorer.rawDays]", diff --git a/src/templates/finops-hub/main.bicep b/src/templates/finops-hub/main.bicep index 5ae523c94..f4902faf9 100644 --- a/src/templates/finops-hub/main.bicep +++ b/src/templates/finops-hub/main.bicep @@ -51,11 +51,11 @@ param enableSpotRecommendations bool = false @description('Optional. Name of the Azure Data Explorer cluster to use for advanced analytics. If empty, Azure Data Explorer will not be deployed. Required to use with Power BI if you have more than $2-5M/mo in costs being monitored. Default: "" (do not use).') param dataExplorerName string = '' -@description('Optional. Enable disk encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.') -param enableAdxDiskEncryption bool = false +@description('Optional. Enable disk encryption on the Azure Data Explorer cluster. Default: false.') +param enableDataExplorerDiskEncryption bool = false @description('Optional. Enable double encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.') -param enableAdxDoubleEncryption bool = false +param enableDataExplorerDoubleEncryption bool = false // https://learn.microsoft.com/azure/templates/microsoft.kusto/clusters?pivots=deployment-language-bicep#azuresku @description('Optional. Name of the Azure Data Explorer SKU. Default: "Dev(No SLA)_Standard_D11_v2".') @@ -190,8 +190,8 @@ module hub 'modules/hub.bicep' = { enableAHBRecommendations: enableAHBRecommendations enableSpotRecommendations: enableSpotRecommendations dataExplorerName: dataExplorerName - enableAdxDiskEncryption: enableAdxDiskEncryption - enableAdxDoubleEncryption: enableAdxDoubleEncryption + enableDataExplorerDiskEncryption: enableDataExplorerDiskEncryption + enableDataExplorerDoubleEncryption: enableDataExplorerDoubleEncryption dataExplorerSku: dataExplorerSku dataExplorerCapacity: dataExplorerCapacity fabricQueryUri: fabricQueryUri diff --git a/src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Analytics/app.bicep b/src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Analytics/app.bicep index 75c018e15..7161af5f1 100644 --- a/src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Analytics/app.bicep +++ b/src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Analytics/app.bicep @@ -28,11 +28,11 @@ param core CoreMetadata @maxLength(22) param clusterName string = '' -@description('Optional. Enable disk encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.') -param enableAdxDiskEncryption bool = false +@description('Optional. Enable disk encryption on the Azure Data Explorer cluster. Default: false.') +param enableDataExplorerDiskEncryption bool = false @description('Optional. Enable double encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.') -param enableAdxDoubleEncryption bool = false +param enableDataExplorerDoubleEncryption bool = false // https://learn.microsoft.com/azure/templates/microsoft.kusto/clusters?pivots=deployment-language-bicep#azuresku @description('Optional. Name of the Azure Data Explorer SKU. Default: "Dev(No SLA)_Standard_E2a_v4".') @@ -148,10 +148,10 @@ var ftkReleaseUri = indexOf(finOpsToolkitVersion, '-dev') != -1 var useFabric = !empty(fabricQueryUri) var useAzure = !useFabric && !empty(clusterName) -var diskEncryptionProperties = !enableAdxDiskEncryption ? {} : { +var diskEncryptionProperties = !enableDataExplorerDiskEncryption ? {} : { enableDiskEncryption: true } -var doubleEncryptionProperties = !enableAdxDoubleEncryption ? {} : { +var doubleEncryptionProperties = !enableDataExplorerDoubleEncryption ? {} : { enableDoubleEncryption: true } diff --git a/src/templates/finops-hub/modules/hub.bicep b/src/templates/finops-hub/modules/hub.bicep index d1062abc3..ecf98d59d 100644 --- a/src/templates/finops-hub/modules/hub.bicep +++ b/src/templates/finops-hub/modules/hub.bicep @@ -68,11 +68,11 @@ param fabricCapacityUnits int = 2 @description('Optional. Name of the Azure Data Explorer cluster to use for advanced analytics. If empty, Azure Data Explorer will not be deployed. Required to use with Power BI if you have more than $2-5M/mo in costs being monitored. Default: "" (do not use).') param dataExplorerName string = '' -@description('Optional. Enable disk encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.') -param enableAdxDiskEncryption bool = false +@description('Optional. Enable disk encryption on the Azure Data Explorer cluster. Default: false.') +param enableDataExplorerDiskEncryption bool = false @description('Optional. Enable double encryption on the Azure Data Explorer cluster. Can only be enabled during cluster creation. Default: false.') -param enableAdxDoubleEncryption bool = false +param enableDataExplorerDoubleEncryption bool = false // https://learn.microsoft.com/azure/templates/microsoft.kusto/clusters?pivots=deployment-language-bicep#azuresku @description('Optional. Name of the Azure Data Explorer SKU. Ignore when using Microsoft Fabric or not deploying Data Explorer. Default: "Dev(No SLA)_Standard_D11_v2".') @@ -313,8 +313,8 @@ module analytics 'Microsoft.FinOpsHubs/Analytics/app.bicep' = if (useFabric || u fabricQueryUri: fabricQueryUri fabricCapacityUnits: fabricCapacityUnits clusterName: dataExplorerName - enableAdxDiskEncryption: enableAdxDiskEncryption - enableAdxDoubleEncryption: enableAdxDoubleEncryption + enableDataExplorerDiskEncryption: enableDataExplorerDiskEncryption + enableDataExplorerDoubleEncryption: enableDataExplorerDoubleEncryption clusterSku: dataExplorerSku clusterCapacity: dataExplorerCapacity rawRetentionInDays: dataExplorerRawRetentionInDays diff --git a/src/templates/finops-hub/test/main.test.bicep b/src/templates/finops-hub/test/main.test.bicep index 3d4ca2693..d1d0362f0 100644 --- a/src/templates/finops-hub/test/main.test.bicep +++ b/src/templates/finops-hub/test/main.test.bicep @@ -22,8 +22,8 @@ module hubWithAdxEncryption '../main.bicep' = { hubName: '${uniqueName}-adx' location: location dataExplorerName: '${uniqueName}-adx' - enableAdxDiskEncryption: true - enableAdxDoubleEncryption: true + enableDataExplorerDiskEncryption: true + enableDataExplorerDoubleEncryption: true } }