# Ensure Public Network Access on Recovery Services Vaults is Disabled

- Source: https://support.icompaas.com/support/solutions/articles/62000234847-ensure-public-network-access-on-recovery-services-vaults-is-disabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure Storage Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112694) › [Azure Storage Services Benchmark](https://support.icompaas.com/support/solutions/folders/62000169262)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:** Level 1

**Description:** Disabling public network access on Azure Recovery Services Vaults restricts access to the vault exclusively through private networks or trusted virtual networks. This prevents the vault from being accessible over the public internet, reducing the risk of unauthorized access and data exposure.

**Rationale:** Allowing public network access increases the attack surface and can expose backup vaults to threats from the internet. Disabling it enforces strict network boundaries, ensuring only authorized traffic within private networks can access backup data, thus improving security and compliance.

**Impact:**

-   Pros:  
    
    -   Reduces exposure to external threats by blocking public internet access.  
        
    -   Supports compliance with organizational and regulatory network security policies.  
        
    -   Encourages use of secure private connectivity like Azure Private Link.  
        
-   Cons:  
    
    -   May require application and service reconfiguration to use private endpoints.  
        
    -   Could disrupt existing workflows that rely on public endpoints if not planned properly.  
        

**Default Value:** Public network access is typically enabled by default on Recovery Services Vaults.

**Pre-requisites:**

-   Azure permissions to modify vault network and firewall settings.  
    
-   Knowledge of existing network architecture and dependencies.  
    

### **Remediation**

**Test Plan:**

**Using Azure Portal:**

1.  Go to [https://portal.azure.com](https://portal.azure.com/).  
    
2.  Navigate to Recovery Services Vaults and select the target vault.  
    
3.  Under Networking or Firewalls and virtual networks, check the Public network access setting.  
    
4.  Verify that public access is set to Disabled or restricted to selected networks only.  
    

**Using Azure CLI:**

1\. Check public network access status:  

az backup vault show --name <vault-name> --resource-group <resource-group> --query properties.publicNetworkAccess

2\. Confirm the output is Disabled.  

### **Implementation Plan**

**Using Azure Portal:**

1.  Navigate to the vault’s Networking or Firewall settings.  
    
2.  Set Public network access to Disabled or restrict to selected virtual networks.  
    
3.  Save and verify the change.  
    

**Using Azure CLI:**

1\. Disable public network access:  

az backup vault update --name <vault-name> --resource-group <resource-group> --set properties.publicNetworkAccess=Disabled

2\. Confirm the update.  

### **Backout Plan**

**Using Azure Portal:**

1.  Re-enable public network access if necessary by changing settings to Enabled or All networks.  
    
2.  Notify affected teams and monitor.  
    

**Using Azure CLI:**

1\. Enable public network access:  

az backup vault update --name <vault-name> --resource-group <resource-group> --set properties.publicNetworkAccess=Enabled

  

**References:**

-   [Azure Recovery Services Vault Network Security  
    ](https://learn.microsoft.com/en-us/azure/backup/backup-network-security)
    
-   [Control Public Network Access to Azure Resources](https://learn.microsoft.com/en-us/azure/virtual-network/manage-service-endpoints)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.