Azure HDInsight clusters should use encryption at host to encrypt data at rest
Azure HDInsight clusters should use encryption at host to encrypt data at rest. When you enable encryption at host, data stored on the VM host is encrypted at rest and flows encrypted to the Storage service.
Enabling encryption at host helps protect and safeguard your data to meet your organizational security and compliance commitments. When you enable encryption at host, data stored on the VM host is encrypted at rest and flows encrypted to the Storage service.
What this control checks
Checks whether encryption at host is turned on for each Azure HDInsight cluster
Common pitfalls
Missing encryptionAtHost property also fails
The policy targets clusters where diskEncryptionProperties.encryptionAtHost does not exist or equals false.
Policy effect allows Audit, Deny or Disabled
The effect parameter allows Audit, Deny or Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure HDInsight clusters should use encryption at host to encrypt data at rest" (1fd32ebd-e4c3-4e13-a54a-d7422d4d95f6); PowerPipe control azure_compliance.control.hdinsight_cluster_encryption_at_host_enabled.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-12 (Cryptographic Key Establishment and Management).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-12 (Cryptographic Key Establishment And Management).
Framework mappings
The clauses this control is mapped to in each framework.
- Cryptographic Key Establishment And Management (SC-12)
FedRAMP Moderate Baseline Rev 4
- SC-12 Cryptographic Key Establishment And Management
- 3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC.L2-3.13.10 Establish and manage cryptographic keys for cryptography employed in organizational systems
- SC-12 Cryptographic Key Establishment And Management
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
hdinsight_cluster_encryption_at_host_enabled - Powerpipe Control:
azure_compliance.control.hdinsight_cluster_encryption_at_host_enabled - Azure Policy Definition:
1fd32ebd-e4c3-4e13-a54a-d7422d4d95f6
Last reviewed: 2026-10-13