Event Grid domains should have public network access restrictions configured
Ensure that Event Grid Domain public network access is disabled. This control is non-compliant if Event Grid domains have public network access enabled. Disabling it keeps the resource from being exposed on the public internet.
Disabling public network access improves security by ensuring that the resource isn't exposed on the public internet. This will help protect them against data leakage risks.
What this control checks
Event Grid domains must have public network access disabled; Enabled fails.
Common pitfalls
Modify only applies from a given API version
The Modify policy's addOrReplace operation on Microsoft.EventGrid/domains/publicNetworkAccess has the condition [greaterOrEquals(requestContext().apiVersion, '2020-04-01-preview')].
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Modify - Configure Azure Event Grid domains to disable public network access" (898e9824-104c-4965-8e0e-5197588fa5d4) and "Azure Event Grid domains should disable public network access" (f8f774be-6aee-492a-9e29-486ef81f3a68); PowerPipe controls azure_compliance.control.eventgrid_domain_private_link_used and azure_compliance.control.eventgrid_domain_restrict_public_access.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_106.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
eventgrid_domain_restrict_public_access - Checkov Check:
CKV_AZURE_106 - Powerpipe Controls:
azure_compliance.control.eventgrid_domain_private_link_used,azure_compliance.control.eventgrid_domain_restrict_public_access - Azure Policy Definitions:
898e9824-104c-4965-8e0e-5197588fa5d4,f8f774be-6aee-492a-9e29-486ef81f3a68
Last reviewed: 2026-10-11