Use customer managed keys to encrypt data on Azure Data Explorer clusters

Azure Storage encrypts all data in the storage account at REST and by default, data is encrypted with Microsoft-managed keys. CMK provides more customer control over key management and requires Key Vault for managing the keys. This new capability is also a critical piece in the JEDI cloud contract with the Department of Defense.

To enable Customer Managed Keys

1. Create an Azure Data Explorer cluster with system assigned identity using C# or an ARM template (Azure Portal support coming soon).
2. Add the cluster to the access policy of the Key Vault that contains your keys.
3. Configure your Azure Data Explorer cluster with the Key Vault properties.

You are good to go!

If you delete or disable the key or delete the Key Vault, your cluster will block (within 1 hour) all access to the data and the cluster will be stopped.

For more information, read the following documents:

• Configure managed identities for Azure Data Explorer cluster.
• Configure customer-managed-keys using C#
• Configure customer-managed-keys using the Azure Resource Manager template

Azure Data Explorer team