Azure Compliance ControlsAzure API Management
API Management services should use a virtual network
Deployment of an API Management service in a virtual network places the service in a non-internet routable network that you control access to. The developer portal and API gateway can be internet-facing or only within the virtual network.
What this control checks
API Management services should use a virtual network
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SC-7(3) Access Points
Related controls
- Storage accounts should use a virtual network service endpoint
- App Configuration should use private link
- Application Insights components should prohibit log ingestion and querying from public networks
- Virtual machines should have all network ports restricted by their associated network security groups
- Network load balancers should use standard SKUs as a minimum
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
apimanagement_service_with_virtual_network - Powerpipe Control:
azure_compliance.control.apimanagement_service_with_virtual_network - Azure Policy Definition:
ef619a2c-cc4d-4d03-b2ba-8c94a834d85b
Last reviewed: 2026-10-09