Data factories should have public network access disabled
Disabling public network access improves security by ensuring that your Data Factory is not exposed on the public internet. Azure Data Factory can then only be accessed from a private endpoint. The check looks at `publicNetworkAccess` on Data Factory.
Disabling public network access improves security by ensuring that your Data Factory is not exposed on the public internet. Disabling the public network access property improves security by ensuring your Azure Data Factory can only be accessed from a private endpoint. Disabling public network access can reduce data leakage risks.
What this control checks
Data Factory publicNetworkAccess must be Disabled; Enabled fails.
Common pitfalls
Public access is set to true by default
Data Factory has public access set to true by default.
Applies only to self-hosted integration runtime
Disabling public network access is applicable only to the self-hosted integration runtime, not to Azure Integration Runtime and SQL Server Integration Services (SSIS) Integration Runtime.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Configure Data Factories to disable public network access" (08b1442b-7789-4130-8506-4f99a97226a7) and "Public network access on Azure Data Factory should be disabled" (1cf164be-6819-4a50-b8fa-4bcaa4f98fb6); PowerPipe control azure_compliance.control.data_factory_public_network_access_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_104; Trivy check AZU-0035.
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 2.2.1.1 (Ensure public network access is Disabled).
Framework mappings
The clauses this control is mapped to in each framework.
- 2.2.1.1 Ensure public network access is Disabled
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
data_factory_public_network_access_disabled - Checkov Check:
CKV_AZURE_104 - Powerpipe Control:
azure_compliance.control.data_factory_public_network_access_disabled - Azure Policy Definitions:
08b1442b-7789-4130-8506-4f99a97226a7,1cf164be-6819-4a50-b8fa-4bcaa4f98fb6 - Trivy Check:
AZU-0035
Last reviewed: 2026-10-11