Data factories should use private link

Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. By mapping private endpoints to Azure Data Factory, data leakage risks are reduced.

By mapping private endpoints to Azure Data Factory, data leakage risks are reduced.

What this control checks

Checks that each data factory has private link configured

Common pitfalls

Private endpoint connection must be Approved

The existence condition requires Microsoft.DataFactory/factories/privateEndpointConnections/privateLinkServiceConnectionState.status to equal Approved.

Effect only audits or is disabled

The effect parameter allows AuditIfNotExists and Disabled. The effect defaults to AuditIfNotExists.

Audit evidence

Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Data Factory should use private link" (8b0323be-cc25-4b61-935d-002c3798c6ea); PowerPipe control azure_compliance.control.data_factory_uses_private_link.

Framework-specific interpretation

NIST SP 800-53 Rev 5: Mapped to AC-17 (Remote Access), AC-17(1) (Monitoring and Control), AC-4 (Information Flow Enforcement) and 2 more clauses.

FedRAMP Moderate Baseline Rev 4: Mapped to AC-17 (Remote Access), AC-17(1) (Automated Monitoring/Control), AC-4 (Information Flow Enforcement) and 2 more clauses.

Framework mappings

The clauses this control is mapped to in each framework.

NIST SP 800-53 Rev 5

AC-17 Remote Access
AC-17(1) Monitoring And Control
Information Flow Enforcement (AC-4)
SC-7: Boundary Protection
SC-7(3) Access Points

FedRAMP Moderate Baseline Rev 4

AC-4 Information Flow Enforcement
AC-17 (3): Managed Access Control Points
AC-17(1) Automated Monitoring/Control
SC-7: Boundary Protection
SC-7(3) Access Points

NIST SP 800-171 Rev 2

3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
3.1.3 Control the flow of CUI in accordance with approved authorizations
3.1.12: Monitor and control remote access sessions.
3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
3.1.14 Route remote access via managed access control points

3 more clauses

3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks

CIS Azure Benchmark v4.0.0

2.2.2.1 Ensure Private Endpoints are used to access {service}

CMMC 2.0 Level 2

AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
AC.L2-3.1.12 Monitor and control remote access sessions
AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
AC.L2-3.1.14 Route remote access via managed access control points

3 more clauses

SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems

FedRAMP High

AC-4 Information Flow Enforcement
AC-17 Remote Access
AC-17(1) Automated Monitoring / Control
SC-7 Boundary Protection
SC-7(3) Access Points

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf Control: data_factory_uses_private_link
Powerpipe Control: azure_compliance.control.data_factory_uses_private_link
Azure Policy Definition: 8b0323be-cc25-4b61-935d-002c3798c6ea

Last reviewed: 2026-10-11

View all Azure controls →