Azure Compliance ControlsAzure App Service
App Service apps should use a virtual network service endpoint
Use virtual network service endpoints to restrict access to your app from selected subnets from an Azure virtual network. The powerpipe check appservice_web_app_use_virtual_service_endpoint covers App Service apps.
What this control checks
App Service apps should use a virtual network service endpoint
Framework mappings
The clauses this control is mapped to in each framework.
- 0805.01m1Organizational.12-01.m 01.04 Network Access Control
- 0806.01m2Organizational.12356-01.m 01.04 Network Access Control
- 0861.09m2Organizational.67-09.m 09.06 Network Security Management
- 0894.01m2Organizational.7-01.m 01.04 Network Access Control
Related controls
- App Service apps should have App Service authentication configured
- App Service plans should not use free, shared, or basic SKUs
- App Service apps should have 'Register with Azure Active Directory' enabled
- Cosmos DB accounts should have 'Firewalls & Networks' limited to selected networks instead of all networks
- Azure Key Vaults should use private link
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_use_virtual_service_endpoint - Powerpipe Control:
azure_compliance.control.appservice_web_app_use_virtual_service_endpoint
Last reviewed: 2026-10-11