Container registries should have public network access disabled
Disabling public network access ensures that container registries are not exposed on the public internet. Ensure that container registries public network access is disabled. Creating private endpoints can limit exposure of container registry resources.
Disabling public network access improves security by ensuring that container registries are not exposed on the public internet. Disable public network access for your Container Registry resource so that it's not accessible over the public internet. This can reduce data leakage risks.
What this control checks
Container registry publicNetworkAccess must be Disabled; any other value fails.
Common pitfalls
Audit is the default effect
The effect parameter has a defaultValue of Audit. The allowed values are Audit, Deny, and Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Public network access should be disabled for Container registries" (0fdf0491-d080-4575-b627-ad0e843cba0f) and "Configure Container registries to disable public network access" (a3701552-92ea-433e-9d17-33b7f1208fc9); Prowler check containerregistry_not_publicly_accessible (prowler azure --checks containerregistry_not_publicly_accessible); PowerPipe control azure_compliance.control.container_registry_public_network_access_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_139.
Framework-specific interpretation
SOC 2: Mapped to CC6.1 (The entity implements logical access security software, infrastructure, and architectures over protected information...).
ISO/IEC 27001:2022: Mapped to A.8.20 (Network Security), A.8.21 (Security of Network Services) and A.8.22 (Segregation of Networks).
NIS2 Directive (EU 2022/2555): Mapped to 11.1.1 (For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish...), 11.6.1 (The relevant entities shall implement secure authentication procedures and technologies based on access restrictions...), 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives
- A.8.20 Network security
- A.8.21 Security of network services
- A.8.22 Segregation of networks
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 2.2.1.1 Ensure public network access is Disabled
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- OPS-32.01B Guidelines and instructions with technical and organisational measures for the planning and management of containers are documented, communicated and provided in accordance with SP-01. These guidelines and instructions contain specifications for the entire container life cycle...
- PSS-11.01B If cloud service customers operate virtual machines or containers with the cloud service, the cloud service provider ensures the following aspects: - Cloud service customers can restrict the selection of images of virtual machines or containers according to their specifications, so...
- 164.312(a)(1) Access control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
container_registry_public_network_access_disabled - Checkov Check:
CKV_AZURE_139 - Powerpipe Control:
azure_compliance.control.container_registry_public_network_access_disabled - Prowler Check:
containerregistry_not_publicly_accessible - Azure Policy Definitions:
0fdf0491-d080-4575-b627-ad0e843cba0f,a3701552-92ea-433e-9d17-33b7f1208fc9
Last reviewed: 2026-10-11