Log Analytics workspaces should prohibit log ingestion and querying from public networks
Improve workspace security by blocking log ingestion and querying from public networks. Only private-link connected networks will be able to ingest and query logs on this workspace.
Only private-link connected networks will be able to ingest and query logs on this workspace.
What this control checks
Log Analytics workspaces should not allow log ingestion or querying from public networks
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.log_analytics_workspace_block_log_ingestion_and_querying_from_public.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to PR.PS-04 (Log records are generated and made available for continuous monitoring.).
Framework mappings
The clauses this control is mapped to in each framework.
- 3.1.g Trails
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
log_analytics_workspace_block_log_ingestion_and_querying_from_public - Powerpipe Control:
azure_compliance.control.log_analytics_workspace_block_log_ingestion_and_querying_from_public
Last reviewed: 2026-10-13