Azure Recovery Services vaults should use private link for backup
Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. By mapping private endpoints to Azure Recovery Services vaults, data leakage risks are reduced.
By mapping private endpoints to Azure Recovery Services vaults, data leakage risks are reduced.
What this control checks
Passes when the value is Enabled; any other value raises an alarm
Common pitfalls
Approved connection with .backup id is required
The policy counts privateEndpointConnections entries where privateLinkServiceConnectionState.status equals Approved, provisioningState equals Succeeded and id contains .backup. The effect applies when the count is less than 1.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Recovery Services vaults should use private link for backup" (deeddb44-9f94-4903-9fa0-081d524406e3); PowerPipe control azure_compliance.control.recovery_service_vault_uses_private_link_for_backup.
Framework-specific interpretation
RBI IT Framework for NBFCs: Mapped to 6 (Business Continuity Planning (BCP) and Disaster Recovery), 6.2 (Recovery strategy / Contingency Plan), 6.3 (Recovery strategy / Contingency Plan) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- 6 Business Continuity Planning (BCP) and Disaster Recovery
- 6.2 Recovery strategy / Contingency Plan
- 6.3 Backup and Recovery
- 6.4 Recovery strategy / Contingency Plan
Related controls
- Azure SQL databases should have public network access disabled
- Virtual machines should be protected by Azure Backup
- Data factories should have public network access disabled
- Azure Cache for Redis should be in a virtual network
- Cognitive Services accounts should have network access restrictions configured
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
recovery_service_vault_uses_private_link_for_backup - Powerpipe Control:
azure_compliance.control.recovery_service_vault_uses_private_link_for_backup - Azure Policy Definition:
deeddb44-9f94-4903-9fa0-081d524406e3
Last reviewed: 2026-10-14