Key vaults should have public network access disabled
Disable public network access for your key vault so that it's not accessible over the public internet. This can reduce data leakage risks. The Azure Policy check looks at the vault property `publicNetworkAccess`.
Disable public network access for your key vault so that it's not accessible over the public internet. This can reduce data leakage risks.
What this control checks
Passes if a key vault has public network access disabled, fails if it is enabled
Common pitfalls
Internet exposure alongside a private endpoint
Internet exposure alongside a private endpoint breaks isolation and expands attack surface.
Azure services can be allowed to bypass
The default action of the Network ACL should be set to deny for when IPs are not matched. Azure services can be allowed to bypass.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Azure Key Vault should disable public network access" (405c5871-3e91-4644-8a63-58e19d68ff5b), "Azure Key Vault should have firewall enabled or public network access disabled" (55615ac9-af46-4a59-874e-391cc3dfb490) and "Configure key vaults to enable firewall" (ac673a9a-f77d-4846-b2d8-a57f8e1c01dc); Prowler check keyvault_access_only_through_private_endpoints (prowler azure --checks keyvault_access_only_through_private_endpoints); PowerPipe controls azure_compliance.control.keyvault_vault_private_link_used, azure_compliance.control.keyvault_vault_public_network_access_disabled and azure_compliance.control.keyvault_vault_use_virtual_service_endpoint.
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 2.2.1.1 (Ensure public network access is Disabled) and 9.3.7 (Ensure that Public Network Access when using Private Endpoint is disabled).
CIS Azure Benchmark v5.0.0: Mapped to 8.3.7 (Ensure Public Network Access is Disabled).
RBI Cyber Security Framework for UCBs: Mapped to ANNEX-I-1-3 (Annex I (1.3) - Appropriately manage and provide protection within and outside UCB/network, keeping in mind how the...).
BSI C5:2025: Mapped to CRY-10.01AC (For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security...), CRY-10.01B (The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic...), IAM-10.01B (The cloud service provider ensures that access to its internal data and system functions is controlled and restricted...) and 3 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 2.2.1.1 Ensure public network access is Disabled
- 9.3.7 Ensure that Public Network Access when using Private Endpoint is disabled
- 8.3.7 Ensure Public Network Access is Disabled
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.
- CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
1 more clause
- PSS-07.02B The cloud service provider distributes credentials using additional security mechanisms to verify the identity of the recipient (e.g. multi-factor authentication), validate the request and protect the credentials.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_vault_public_network_access_disabled - Powerpipe Controls:
azure_compliance.control.keyvault_vault_private_link_used,azure_compliance.control.keyvault_vault_public_network_access_disabled,azure_compliance.control.keyvault_vault_use_virtual_service_endpoint - Prowler Check:
keyvault_access_only_through_private_endpoints - Azure Policy Definitions:
405c5871-3e91-4644-8a63-58e19d68ff5b,55615ac9-af46-4a59-874e-391cc3dfb490,ac673a9a-f77d-4846-b2d8-a57f8e1c01dc - Trivy Check:
AZU-0013
Last reviewed: 2026-10-13