API Management services should use a virtual network
Deployment of an API Management service in a virtual network places the service in a non-internet routable network that you control access to. The developer portal and API gateway can be internet-facing or only within the virtual network.
Azure Virtual Network deployment provides enhanced security, isolation and allows you to place your API Management service in a non-internet routable network that you control access to.
What this control checks
API Management services should use a virtual network
Common pitfalls
Default SKU list is Developer and Premium
The evaluatedSkuNames parameter has a default value of Developer and Premium. It is described as the list of API Management SKUs against which this policy will be evaluated.
Effect applies when virtualNetworkType is None
The policy applies its effect when virtualNetworkType equals None.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "API Management services should use a virtual network" (ef619a2c-cc4d-4d03-b2ba-8c94a834d85b); PowerPipe control azure_compliance.control.apimanagement_service_with_virtual_network.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).
FedRAMP Moderate Baseline Rev 4: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SC-7(3) Access Points
Related controls
- Storage accounts should use a virtual network service endpoint
- App Configuration should use private link
- Application Insights components should prohibit log ingestion and querying from public networks
- Virtual machines should have all network ports restricted by their associated network security groups
- Network load balancers should use standard SKUs as a minimum
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
apimanagement_service_with_virtual_network - Powerpipe Control:
azure_compliance.control.apimanagement_service_with_virtual_network - Azure Policy Definition:
ef619a2c-cc4d-4d03-b2ba-8c94a834d85b
Last reviewed: 2026-10-09