Storage accounts should prohibit public access
Anonymous public read access to containers and blobs in Azure Storage might present security risks. Microsoft recommends preventing public access to a storage account unless your scenario requires it. Prowler checks that Public Network Access is disabled.
Leaving public network access enabled exposes the storage account endpoints to the public Internet, widening the attack surface and undermining defense in depth. This increases the risk of unauthorized access, data exfiltration, and reconnaissance against the account, especially when combined with weak network rules or overly permissive access policies.
What this control checks
Storage accounts must disallow public access; public_network_access_enabled must be false.
Common pitfalls
Independent from Allow Blob Anonymous Access
This is independent from the 'Allow Blob Anonymous Access' setting.
Validate client connectivity before disabling
Validate client connectivity before disabling public access in production.
Audit evidence
Evidence that deployed resources meet this control: Prowler check storage_account_public_network_access_disabled (prowler azure --checks storage_account_public_network_access_disabled); PowerPipe control azure_compliance.control.storage_account_block_public_access.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_59.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 10.3.2.2 Ensure that 'Public Network Access' is 'Disabled' for storage accounts
- 9.3.2.2 Ensure that 'Public Network Access' is 'Disabled' for storage accounts
- 3.7 Ensure that 'Public Network Access' is `Disabled' for storage accounts
- 4.6 Ensure that 'Public Network Access' is `Disabled' for storage accounts
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SC-7(3) Access Points
Related controls
- Storage accounts should have the default network access rule set to deny
- Storage accounts should have geo-redundant storage enabled
- Storage accounts should have soft delete enabled
- Cognitive Services accounts should have public network access disabled
- Databricks workspaces should have 'Allow Public Network Access' set to 'Disabled'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_block_public_access - Checkov Check:
CKV_AZURE_59 - Powerpipe Control:
azure_compliance.control.storage_account_block_public_access - Prowler Check:
storage_account_public_network_access_disabled
Last reviewed: 2026-10-15