Recovery Services vaults should use private link
Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. By mapping private endpoints to Azure Recovery Services vaults, data leakage risks are reduced.
By mapping private endpoints to Azure Recovery Services vaults, data leakage risks are reduced. Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination.
What this control checks
Recovery Services vaults must have private link enabled for site recovery.
Common pitfalls
Only Site Recovery connections count
The policy counts privateEndpointConnections only when the id contains SiteRecovery. The privateLinkServiceConnectionState.status must equal Approved and the provisioningState must equal Succeeded.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "[Preview]: Recovery Services vaults should use private link" (11e3da8c-1d68-4392-badd-0ff3c43ab5b0); PowerPipe control azure_compliance.control.recovery_service_vault_uses_private_link.
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 2.2.2.1 (Ensure Private Endpoints are used to access {service}).
RBI IT Framework for NBFCs: Mapped to 6 (Business Continuity Planning (BCP) and Disaster Recovery) and 6.4 (Recovery strategy / Contingency Plan).
Framework mappings
The clauses this control is mapped to in each framework.
- 2.2.2.1 Ensure Private Endpoints are used to access {service}
- 6 Business Continuity Planning (BCP) and Disaster Recovery
- 6.4 Recovery strategy / Contingency Plan
Related controls
- Azure SQL databases should have private endpoint connections enabled
- IoT Hub device provisioning service instances should use private link
- Storage accounts should have public network access disabled
- Managed disks should not have 'Disk Network Access' set to 'Enable public access from all networks'
- Storage accounts should have soft delete enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
recovery_service_vault_uses_private_link - Powerpipe Control:
azure_compliance.control.recovery_service_vault_uses_private_link - Azure Policy Definition:
11e3da8c-1d68-4392-badd-0ff3c43ab5b0
Last reviewed: 2026-10-14