Skip to content

Azure.ADX.PublicAccess.md

Latest commit

 

History

History
89 lines (69 loc) · 2.56 KB

Azure.ADX.PublicAccess.md

File metadata and controls

89 lines (69 loc) · 2.56 KB
Raw
reviewed 2025-11-04
severity Critical
pillar Security
category SE:06 Network controls
resource Data Explorer
resourceType Microsoft.Kusto/clusters
online version https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ADX.PublicAccess/

Disable public network access on Data Explorer clusters

SYNOPSIS

Azure Data Explorer (ADX) clusters should have public network access disabled.

DESCRIPTION

Disabling public network access improves security by ensuring that the cluster isn't exposed on the public internet. You can control exposure of your clusters by creating private endpoints instead.

RECOMMENDATION

Consider disabling public network access on Azure Data Explorer clusters, using private endpoints to control connectivity.

EXAMPLES

Configure with Azure template

To deploy Data Explorer clusters that pass this rule:

  • Set the properties.publicNetworkAccess property to Disabled.

For example:

{
  "type": "Microsoft.Kusto/clusters",
  "apiVersion": "2024-04-13",
  "name": "[parameters('name')]",
  "location": "[parameters('location')]",
  "sku": {
    "name": "Standard_D11_v2",
    "tier": "Standard"
  },
  "identity": {
    "type": "SystemAssigned"
  },
  "properties": {
    "enableDiskEncryption": true,
    "publicNetworkAccess": "Disabled"
  }
}

Configure with Bicep

To deploy Data Explorer clusters that pass this rule:

  • Set the properties.publicNetworkAccess property to Disabled.

For example:

resource adx 'Microsoft.Kusto/clusters@2024-04-13' = {
  name: name
  location: location
  sku: {
    name: 'Standard_D11_v2'
    tier: 'Standard'
  }
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    enableDiskEncryption: true
    publicNetworkAccess: 'Disabled'
  }
}

LINKS