Regions with newly created virtual networks should have Network Watcher deployed
This policy creates a network watcher resource in regions with virtual networks. You need to ensure existence of a resource group named `networkWatcherRG`, which will be used to deploy network watcher instances.
What this control checks
Network Watcher is deployed in each region that has a newly created virtual network
Common pitfalls
Needs resource group networkWatcherRG
You need to ensure existence of a resource group named networkWatcherRG, which will be used to deploy network watcher instances.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Deploy network watcher when virtual networks are created" (a9b99dd8-06c5-4317-8629-9d86a3c6e7d9); PowerPipe control azure_compliance.control.network_watcher_in_regions_with_virtual_network.
Framework-specific interpretation
HIPAA HITRUST v9.2: Mapped to 0894.01m2Organizational.7-01.m (01.04 Network Access Control).
Framework mappings
The clauses this control is mapped to in each framework.
- 0894.01m2Organizational.7-01.m 01.04 Network Access Control
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_watcher_in_regions_with_virtual_network - Powerpipe Control:
azure_compliance.control.network_watcher_in_regions_with_virtual_network - Azure Policy Definition:
a9b99dd8-06c5-4317-8629-9d86a3c6e7d9
Last reviewed: 2026-10-14