Event Hub namespaces should use a virtual network service endpoint
This policy audits any Event Hub not configured to use a virtual network service endpoint. The check looks at Event Hub namespaces (`Microsoft.EventHub/namespaces`) and their virtual network rules.
What this control checks
Pass or fail result for Event Hub namespace use of a virtual network service endpoint
Common pitfalls
Needs a virtualNetworkRules resource
The policy looks for a Microsoft.EventHub/namespaces/virtualNetworkRules resource. Its existenceCondition requires that Microsoft.EventHub/namespaces/virtualNetworkRules/virtualNetworkSubnetId exists.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Event Hub should use a virtual network service endpoint" (d63edb4a-c612-454d-b47d-191a724fcbf0); PowerPipe control azure_compliance.control.eventhub_namespace_use_virtual_service_endpoint.
Framework-specific interpretation
HIPAA HITRUST v9.2: Mapped to 0805.01m1Organizational.12-01.m (01.04 Network Access Control), 0806.01m2Organizational.12356-01.m (01.04 Network Access Control), 0863.09m2Organizational.910-09.m (09.06 Network Security Management) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- 0805.01m1Organizational.12-01.m 01.04 Network Access Control
- 0806.01m2Organizational.12356-01.m 01.04 Network Access Control
- 0863.09m2Organizational.910-09.m 09.06 Network Security Management
- 0894.01m2Organizational.7-01.m 01.04 Network Access Control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
eventhub_namespace_use_virtual_service_endpoint - Powerpipe Control:
azure_compliance.control.eventhub_namespace_use_virtual_service_endpoint - Azure Policy Definition:
d63edb4a-c612-454d-b47d-191a724fcbf0
Last reviewed: 2026-10-13