# Ensure Public Network Access is Disabled (Automated)

- Source: https://support.icompaas.com/support/solutions/articles/62000233914-ensure-public-network-access-is-disabled-automated-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Microsoft Azure Foundations Benchmark v4.0.0](https://support.icompaas.com/support/solutions/62000112681) › [Azure microsoft CIS](https://support.icompaas.com/support/solutions/folders/62000169227)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

#### **Description:**

Disabling public network access ensures that resources within Azure are not exposed to the internet unless explicitly required. This security measure limits the exposure of services to external threats and ensures that only authorized users and systems can access these resources through private network configurations such as Virtual Network (VNet) or VPN.

#### **Rationale:**

Disabling public network access minimizes the attack surface of Azure resources by preventing unauthorized access via the internet. By restricting access to internal networks, organizations can ensure sensitive data and systems are protected from potential external threats. This is particularly important for compliance with security frameworks such as ISO 27001, SOC 2, and HIPAA.

#### **Impact:**

Disabling public network access will enhance security by preventing external access, but it could affect the functionality of services that require internet connectivity for external access, such as public-facing websites or APIs. Organizations must ensure that services needing public access are appropriately configured with firewalls or proxy services that only allow access from trusted sources.

#### **Default Value:**

By default, many Azure resources have public network access enabled. This setting must be manually modified to disable public access.

#### **Pre-requisites:**

-   Azure account.  
    
-   Azure resources (e.g., Azure SQL Database, Storage Accounts, Web Apps).
    
-   A user with the necessary permissions to modify public network access settings (e.g., Owner, Contributor, Network Admin).  
    

#### **Audit:**

1.  Sign in to the Azure portal as a Network Admin, Owner, or Contributor.  
    
2.  Navigate to the relevant Azure resource (e.g., Azure SQL Database, Storage Accounts, Web Apps).  
    
3.  Review the Networking or Firewall settings for the resource and verify that public network access is disabled.
    

#### **Implementation Steps:**

1.  Sign in to the Azure portal with an Owner, Contributor, or Network Admin role.
    
2.  Navigate to the Azure resource that requires public access to be disabled (e.g., SQL Database, Storage Account, or Web App).  
    
3.  For Azure SQL Database:  
    
    -   Go to the Networking section.
        
    -   Under Public Network Access, select Disabled.  
        
    -   Save the changes.  
        
4.  For Azure Storage Account:  
    
    -   Go to the Networking section.
        
    -   Under Public Network Access, select Disabled.  
        
    -   Save the changes.  
        
5.  For Azure Web App:  
    
    -   Go to the Networking section.
        
    -   Under Access Restrictions, ensure that only internal IP ranges or VNets have access. Disable public network access if necessary.  
        
    -   Save the changes.  
        

#### **Backout Plan:**

1.  Sign in to the Azure portal as a Network Admin, Owner, or Contributor.  
    
2.  Navigate to the relevant Azure resource (e.g., SQL Database, Storage Account, or Web App).  
    
3.  Under the Networking or Firewall settings, enable Public Network Access.  
    
4.  Save the changes to revert the resource to public access.  
    

#### **References:**

-   [Azure SQL Database - Configure Firewall Rules](https://docs.microsoft.com/en-us/azure/sql-database/sql-database-firewall-configure)
    
-   [Azure Storage Accounts - Disable Public Access](https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security)
    
-   [Azure Web Apps - Restrict Access  
    ](https://docs.microsoft.com/en-us/azure/app-service/web-sites-restrict-ip-address)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.