Storage accounts should use virtual network rules to restrict network access
Protect your storage accounts from potential threats using virtual network rules as a preferred method instead of IP-based filtering. Disabling IP-based filtering prevents public IPs from accessing your storage accounts.
With the default action set to Allow, the public endpoint is reachable from any network. This removes a network boundary, so stolen access keys or leaked SAS tokens can be abused from anywhere, enabling data exfiltration, tampering, and destructive writes.
What this control checks
Storage accounts must have network access restricted by virtual network rules
Common pitfalls
Any IP rule makes the policy flag the account
The policy flags an account when the count of networkAcls.ipRules[*] is greater than or equal to 1.
Missing network rules block gives unknown result
Network Rules can be defined either directly on the azurerm_storage_account resource, or using the azurerm_storage_account_network_rules resource. If the latter is used, the check is skipped for the azurerm_storage_account resource (which would return as failed).
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Storage accounts should restrict network access using virtual network rules" (2a1a9cdf-e04d-429a-8416-3bfb72a1b26f) and "Storage accounts should restrict network access" (34c877ad-507e-4c82-993e-3452a6e0ad3c); Prowler check storage_default_network_access_rule_is_denied (prowler azure --checks storage_default_network_access_rule_is_denied); PowerPipe controls azure_compliance.control.storage_account_default_network_access_deny, azure_compliance.control.storage_account_default_network_access_rule_denied, azure_compliance.control.storage_account_restrict_network_access and 1 more.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 1.2.1 (As part of their policy on the security of network and information systems referred to in point 1.1., the relevant...), 11.1.1 (For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish...), 11.2.1 (The relevant entities shall provide, modify, remove and document access rights to network and information systems in...) and 3 more clauses.
NIST SP 800-53 Rev 5: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).
FedRAMP Moderate Baseline Rev 4: Mapped to AC-17 (Remote Access), AC-17(1) (Automated Monitoring/Control), AC-4 (Information Flow Enforcement) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 1 Policy on the security of network and information systems
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- 12 Asset management
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- AC-17 (3): Managed Access Control Points
- AC-17(1) Automated Monitoring/Control
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 2.2.1.2 Ensure Network Access Rules are set to Deny-by-default
- 10.3.2.3 Ensure default network access rule for storage accounts is set to deny
- 9.3.2.3 Ensure default network access rule for storage accounts is set to deny
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- Annex I (5.1)
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
- 3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny
- 3.8 Ensure Default Network Access Rule for Storage Accounts is Set to Deny
- 4.7 Ensure Default Network Access Rule for Storage Accounts is Set to Deny
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- AC.L2-3.1.12 Monitor and control remote access sessions
- AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- AC.L2-3.1.14 Route remote access via managed access control points
4 more clauses
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- SC.L2-3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SC-7(3) Access Points
- 164.308(a)(1)(ii)(B) Risk management
- 164.308(a)(4)(ii)(A) Isolating health care clearinghouse functions
- 164.312(a)(1) Access control
Related controls
- Storage accounts should have the default network access rule set to deny
- Storage accounts should use customer-managed key for encryption
- Container registries should not allow unrestricted network access
- Azure Cognitive Search services should have public network access disabled
- Azure Cache for Redis should use private link
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_restrict_network_access - Checkov Check:
CKV_AZURE_35 - Powerpipe Controls:
azure_compliance.control.storage_account_default_network_access_deny,azure_compliance.control.storage_account_default_network_access_rule_denied,azure_compliance.control.storage_account_restrict_network_access,azure_compliance.control.storage_account_use_virtual_service_endpoint - Prowler Check:
storage_default_network_access_rule_is_denied - Azure Policy Definitions:
2a1a9cdf-e04d-429a-8416-3bfb72a1b26f,34c877ad-507e-4c82-993e-3452a6e0ad3c - KICS Query:
a5613650-32ec-4975-a305-31af783153ea - Trivy Check:
AZU-0012
Last reviewed: 2026-10-15