Cognitive Services accounts should have network access restrictions configured
The `cognitive_account_restrict_public_access` control applies to Azure Cognitive Services accounts and their network access settings. Access to an account can be granted to specific Azure virtual networks or to public internet IP address ranges.
With the default action set to Allow, the public endpoint accepts traffic from any network. Prompts, completions, and grounding data are reachable by anyone holding a leaked key or token.
What this control checks
Cognitive Services accounts must restrict network access to allowed networks only.
Common pitfalls
Accounts with public access disabled also pass
Accounts with public network access Disabled also pass.
Public access enabled needs default action Deny
Azure AI services accounts that keep public network access enabled can set the network ACL default action (networkAcls.defaultAction) to Deny, so the public endpoint only accepts traffic from allowed virtual networks and IP ranges.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure AI Services resources should restrict network access" (037eea7a-bd0a-46c5-9a66-03aea78705d3); Prowler checks aiservices_account_network_acls_default_action_deny (prowler azure --checks aiservices_account_network_acls_default_action_deny) and aiservices_account_public_network_access_disabled (prowler azure --checks aiservices_account_public_network_access_disabled); PowerPipe control azure_compliance.control.cognitive_account_restrict_public_access.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).
FedRAMP Moderate Baseline Rev 4: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 2.2.1.2 Ensure Network Access Rules are set to Deny-by-default
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- SC.L2-3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)
Related controls
- Cognitive Services accounts should have local authentication methods disabled
- Storage accounts should have the default network access rule set to deny
- Kubernetes clusters should have public access restrictions configured
- Azure SQL databases should have public network access disabled
- Azure Event Grid domains should use private link
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cognitive_account_restrict_public_access - Powerpipe Control:
azure_compliance.control.cognitive_account_restrict_public_access - Prowler Checks:
aiservices_account_network_acls_default_action_deny,aiservices_account_public_network_access_disabled - Azure Policy Definition:
037eea7a-bd0a-46c5-9a66-03aea78705d3
Last reviewed: 2026-10-11