App Service apps should use a virtual network service endpoint
Use virtual network service endpoints to restrict access to your app from selected subnets from an Azure virtual network. The powerpipe check appservice_web_app_use_virtual_service_endpoint covers App Service apps.
Use virtual network service endpoints to restrict access to your app from selected subnets from an Azure virtual network.
What this control checks
App Service apps should use a virtual network service endpoint
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.appservice_web_app_use_virtual_service_endpoint.
Framework-specific interpretation
HIPAA HITRUST v9.2: Mapped to 0805.01m1Organizational.12-01.m (01.04 Network Access Control), 0806.01m2Organizational.12356-01.m (01.04 Network Access Control), 0861.09m2Organizational.67-09.m (09.06 Network Security Management) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- 0805.01m1Organizational.12-01.m 01.04 Network Access Control
- 0806.01m2Organizational.12356-01.m 01.04 Network Access Control
- 0861.09m2Organizational.67-09.m 09.06 Network Security Management
- 0894.01m2Organizational.7-01.m 01.04 Network Access Control
Related controls
- App Service apps should have App Service authentication configured
- App Service plans should not use free, shared, or basic SKUs
- App Service apps should have 'Register with Azure Active Directory' enabled
- Cosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networks
- Azure Key Vaults should use private link
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_use_virtual_service_endpoint - Powerpipe Control:
azure_compliance.control.appservice_web_app_use_virtual_service_endpoint
Last reviewed: 2026-10-11