# Ensure That 'Firewalls & Networks' Is Limited to Use Selected Networks Instead of All Networks for CosmosDB

- Source: https://support.icompaas.com/support/solutions/articles/62000229902-ensure-that-firewalls-networks-is-limited-to-use-selected-networks-instead-of-all-networks-for-cosmosdb
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Azure Compliance / Control / Check](https://support.icompaas.com/support/solutions/folders/62000168797)
- Last updated: 2026-06-15
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

# Description:

Azure Cosmos DB allows you to control which networks can access the database account. Setting Public network access to Selected networks restricts access to only approved IP ranges and virtual networks. This prevents unwanted access from the public internet.

  

Rationale:

Leaving Public network access = All networks expose  the Cosmos DB endpoint to the entire internet, increasing the risk of unauthorized access or attack. Restricting access to Selected networks ensures only trusted networks and IP addresses can connect.

  

Impact:

Applications not included in the allowed IP list or virtual networks will lose access. You must configure the required IPs or VNets before applying this restriction.

  

Default Value:

By default, many Cosmos DB accounts are created with: Public network access = All networks

  

Pre-requisites:

-   You must have Owner, Contributor, or Cosmos DB Account Contributor permissions.
    
-   Required application IP ranges or virtual networks must be known.  
      
    

Test Plan:

1.  Sign in to Azure Portal: [https://portal.azure.com](https://portal.azure.com/)
    
2.  In the portal, search for Azure Cosmos DB. Select the Cosmos DB account.
    
3.  In the left menu, under Settings, click Networking.
    
4.  Under Public network access, verify that the selected option in the Public network access section is ‘Selected networks.
    
5.  If all networks are selected, then follow the implementation steps.
    

Implementation steps:

1.  Sign in to Azure Portal: [https://portal.azure.com](https://portal.azure.com/)
    
2.  In the portal, search for Azure Cosmos DB. Select the Cosmos DB account.
    

3.  Click Networking under settings.
    
4.  In the left menu, under Settings, click Networking.
    

5.  Under Public network access, change the selection to Selected networks.
    
6.  Add the required access methods, such as:
    

-   Add an existing virtual network, or
    
-   Add IP ranges
    

7.  Click Save to apply the configuration.
    

  

Backout Plan:

1.  Open the Azure portal at [https://portal.azure.com](https://portal.azure.com/).
    
2.  In the portal, search for Azure Cosmos DB and select the account.
    
3.  Under Settings, go to Networking.
    
4.  Change Public network access back to All networks.
    
5.  Click Save to apply the configuration.
    

Reference:

-   [https://learn.microsoft.com/azure/cosmos-db/how-to-configure-firewall](https://learn.microsoft.com/azure/cosmos-db/how-to-configure-firewall)
    
-   [https://learn.microsoft.com/azure/cosmos-db/how-to-configure-vnet](https://learn.microsoft.com/azure/cosmos-db/how-to-configure-vnet)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.