# Ensure That Private Endpoints Are Used for cosmosdb Where Possible

- Source: https://support.icompaas.com/support/solutions/articles/62000229922-ensure-that-private-endpoints-are-used-for-cosmosdb-where-possible
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Azure Compliance / Control / Check](https://support.icompaas.com/support/solutions/folders/62000168797)
- Last updated: 2026-06-15
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

This check verifies that Azure Cosmos DB accounts use Private Endpoints to provide secure connectivity over the Azure Private Link service. Private Endpoints assign a private IP address from a virtual network (VNet), allowing access to Cosmos DB without exposing traffic to the public internet.

  

Rationale:

By default, Azure Cosmos DB can be accessed through public endpoints. Although access can be controlled using firewalls and network rules, public endpoints still increase the attack surface. Private Endpoints provide secure, private connectivity between Azure resources and Cosmos DB over Microsoft's backbone network, reducing the risk of unauthorized access and data exposure.

  

Impact:

-   Reduces exposure of Cosmos DB accounts to the public internet.
    
-   Minimizes the risk of unauthorized access and data exfiltration.
    
-   Enhances network security through private connectivity.
    
-   Supports compliance requirements for data protection and network isolation.
    
-   Improves security posture by eliminating dependency on public IP-based access controls.
    

  

Default Value:

By default, Azure Cosmos DB accounts are accessible through public endpoints. Private Endpoints must be explicitly configured and associated with a Virtual Network.

  

Remediation:

Test Plan:

Using Azure Portal:

1.  Sign in to the Azure Portal.
    
2.  Navigate to Azure Cosmos DB.
    
3.  Select the Cosmos DB account.
    
4.  Under Settings, select Networking.
    
5.  Review the Public network access configuration.
    
6.  Select the Private Endpoint Connections tab.
    
7.  Verify whether one or more approved private endpoints exist.
    
8.  Confirm that applications access Cosmos DB through the private endpoint.
    

  

Implementation steps:

Using Azure Portal:

1.  Sign in to the Azure Portal.
    
2.  Navigate to Azure Cosmos DB.
    
3.  Select the affected Cosmos DB account.
    
4.  Select Networking.
    
5.  Under Private Endpoint Connections, click + Private Endpoint.
    
6.  Configure:
    

-   Subscription
    
-   Resource Group
    
-   Virtual Network
    
-   Subnet
    

8.  Review and create the Private Endpoint.
    
9.  Approve the connection if required.
    
10.  Validate DNS resolution using Azure Private DNS Zones.
     
11.  Once connectivity is confirmed, disable public network access if business requirements allow.
     

Disable Public Access (Recommended)

1.  Navigate to Networking.
    
2.  Under Public Network Access, select Disabled.
    
3.  Save changes.
    
4.  Validate application connectivity through the Private Endpoint.
    

  

Backout Plan:

Using Azure Portal:

1.  Navigate to the Cosmos DB account.
    
2.  Select Networking.
    
3.  Re-enable Public Network Access if application connectivity is impacted.
    
4.  Remove or disconnect the Private Endpoint if required.
    
5.  Validate application access and functionality.
    

  

References:

-   [Azure Cosmos DB Private Endpoints Documentation](https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-configure-private-endpoints?utm_source=chatgpt.com)
    
-   [Azure Private Link Documentation](https://learn.microsoft.com/en-us/azure/private-link/private-link-overview?utm_source=chatgpt.com)
    
-   [Azure Cosmos DB Networking and Firewall Configuration](https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-configure-firewall?utm_source=chatgpt.com)
    
-   [Azure CLI Cosmos DB Commands Reference](https://learn.microsoft.com/en-us/cli/azure/cosmosdb?utm_source=chatgpt.com)
    
-   [Azure Private Endpoint Documentation](https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview?utm_source=chatgpt.com)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.