Storage accounts should use a virtual network service endpoint
This policy audits any Storage Account not configured to use a virtual network service endpoint. The Azure Policy definition targets `Microsoft.Storage/storageAccounts`. The effect is `Audit` by default.
What this control checks
Storage accounts need networkAcls.defaultAction set to Deny and virtualNetworkRules ids.
Common pitfalls
Effect defaults to Audit
The effect parameter has a defaultValue of Audit. The allowed values are Audit and Disabled.
Default action not Deny fails the check
The policy flags Microsoft.Storage/storageAccounts/networkAcls.defaultAction when it notEquals Deny. The policy also flags accounts where Microsoft.Storage/storageAccounts/networkAcls.virtualNetworkRules[*].id exists is false.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Storage Accounts should use a virtual network service endpoint" (60d21c4f-21a3-4d94-85f4-b924e6aeeda4); PowerPipe control azure_compliance.control.storage_account_use_virtual_service_endpoint.
Framework-specific interpretation
HIPAA HITRUST v9.2: Mapped to 0805.01m1Organizational.12-01.m (01.04 Network Access Control), 0806.01m2Organizational.12356-01.m (01.04 Network Access Control) and 0894.01m2Organizational.7-01.m (01.04 Network Access Control).
Framework mappings
The clauses this control is mapped to in each framework.
- 0805.01m1Organizational.12-01.m 01.04 Network Access Control
- 0806.01m2Organizational.12356-01.m 01.04 Network Access Control
- 0894.01m2Organizational.7-01.m 01.04 Network Access Control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_use_virtual_service_endpoint - Powerpipe Control:
azure_compliance.control.storage_account_use_virtual_service_endpoint - Azure Policy Definition:
60d21c4f-21a3-4d94-85f4-b924e6aeeda4
Last reviewed: 2026-10-15