# Ensure That 'Public Network Access' Is 'Disabled' for Storage Accounts

- Source: https://support.icompaas.com/support/solutions/articles/62000234877-ensure-that-public-network-access-is-disabled-for-storage-accounts
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Azure Storage Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112694) › [Azure Storage Services Benchmark](https://support.icompaas.com/support/solutions/folders/62000169262)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability:

-   **Level 1**

Description:  
 Disabling public network access on Azure Storage Accounts restricts connectivity to the storage resources to only private networks or selected trusted networks. This prevents access over the public internet, reducing the attack surface and exposure to unauthorized access.

Rationale:  
 Publicly accessible storage accounts are vulnerable to attacks from the internet. Disabling public network access enforces network-level security controls, ensuring that only authorized private network traffic can reach the storage account, improving overall security posture.

Impact:

Pros:  

-   Minimizes exposure to external threats by blocking public internet access.  
    
-   Supports compliance with network security and data protection standards.  
    
-   Encourages use of private connectivity options such as Private Endpoints.  
    

Cons:  

-   May require reconfiguration of applications and services to use private network paths.  
    
-   Could cause disruptions if clients depend on public endpoints without alternatives.  
    

Default Value:  
 Public network access is enabled by default on many Azure Storage Accounts.

Pre-requisites:

-   Azure subscription and permissions to modify storage account networking settings.  
    
-   Understanding of network architecture and client connectivity requirements.  
    

### **Remediation**

**Test Plan:**

**Using Azure Portal:**

1.  Sign in to [https://portal.azure.com](https://portal.azure.com/).  
    
2.  Navigate to Storage Accounts and select the target account.
    
3.  Go to Networking or Firewalls and virtual networks.  
    
4.  Verify that Public Network Access is set to Disabled.  
    

**Using Azure CLI:**

1.  Check public network access status:  
    
    az storage account show --name --resource-group --query publicNetworkAccess
    
2.  Confirm the output is Disabled.  
    

### **Implementation Plan**

**Using Azure Portal:**

1.  In the storage account Networking settings, set Public Network Access to Disabled.  
    
2.  Save the changes.  
    
3.  Test client connectivity via private networks or Private Endpoints.  
    

**Using Azure CLI:**

1.  Disable public network access:  
    
    az storage account update --name --resource-group --set publicNetworkAccess=Disabled
    
2.  Confirm the change by querying the property again.  
    

### **Backout Plan**

**Using Azure Portal:**

1.  Re-enable public network access by changing the setting to Enabled if needed.
    
2.  Inform stakeholders of the change and monitor for impact.  
    

**Using Azure CLI:**

Enable public network access:  

az storage account update --name --resource-group --set publicNetworkAccess=Enabled

References:

-   [Azure Storage Network Security  
    ](https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security)
    
-   [Control Public Network Access to Azure Resources  
      
    ](https://learn.microsoft.com/en-us/azure/virtual-network/manage-service-endpoints)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.