Container registries should use a virtual network service endpoint
This policy audits any Container Registry not configured to use a virtual network service endpoint. The Azure Policy rule checks `Microsoft.ContainerRegistry/registries` for `networkRuleSet.defaultAction` and `virtualNetworkRules`.
What this control checks
Container registries without a virtual network service endpoint are audited.
Common pitfalls
Policy is in preview
The policy metadata sets preview to true. The policy version is 1.0.0-preview.
Effect only allows Audit or Disabled
The effect parameter has a defaultValue of Audit. The allowedValues for effect are Audit and Disabled.
defaultAction must be Deny
The policy rule matches when Microsoft.ContainerRegistry/registries/networkRuleSet.defaultAction notEquals Deny. The policy rule also matches when Microsoft.ContainerRegistry/registries/networkRuleSet.virtualNetworkRules[*].action exists is false.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "[Preview]: Container Registry should use a virtual network service endpoint" (c4857be7-912a-4c75-87e6-e30292bcdf78); PowerPipe control azure_compliance.control.container_registry_use_virtual_service_endpoint.
Framework-specific interpretation
HIPAA HITRUST v9.2: Mapped to 0805.01m1Organizational.12-01.m (01.04 Network Access Control), 0806.01m2Organizational.12356-01.m (01.04 Network Access Control), 0868.09m3Organizational.18-09.m (09.06 Network Security Management) and 4 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 0805.01m1Organizational.12-01.m 01.04 Network Access Control
- 0806.01m2Organizational.12356-01.m 01.04 Network Access Control
- 0868.09m3Organizational.18-09.m 09.06 Network Security Management
- 0869.09m3Organizational.19-09.m 09.06 Network Security Management
- 0870.09m3Organizational.20-09.m 09.06 Network Security Management
2 more clauses
- 0871.09m3Organizational.22-09.m 09.07 Network Security Management
- 0894.01m2Organizational.7-01.m 01.04 Network Access Control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
container_registry_use_virtual_service_endpoint - Powerpipe Control:
azure_compliance.control.container_registry_use_virtual_service_endpoint - Azure Policy Definition:
c4857be7-912a-4c75-87e6-e30292bcdf78
Last reviewed: 2026-10-11