Container registries should not allow unrestricted network access
Azure container registries by default accept connections over the internet from hosts on any network. Allow access from only specific public IP addresses or address ranges. A registry without an IP/firewall rule or a configured virtual network is unhealthy.
Azure container registries by default accept connections over the internet from hosts on any network. To protect your registries from potential threats, allow access from only specific public IP addresses or address ranges.
What this control checks
Registry needs an IP/firewall rule or a configured virtual network, else unhealthy
Common pitfalls
Registries accept connections from any network
Azure container registries by default accept connections over the internet from hosts on any network.
No IP/firewall rule or virtual network is unhealthy
If your registry doesn't have an IP/firewall rule or a configured virtual network, it will appear in the unhealthy resources.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe controls azure_compliance.control.container_registry_restrict_public_access and azure_compliance.control.container_registry_use_virtual_service_endpoint.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 2.2.1.2 Ensure Network Access Rules are set to Deny-by-default
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SC-7(3) Access Points
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
container_registry_restrict_public_access - Powerpipe Controls:
azure_compliance.control.container_registry_restrict_public_access,azure_compliance.control.container_registry_use_virtual_service_endpoint
Last reviewed: 2026-10-11