Azure Compliance ControlsFoundry Tools
Cognitive Services accounts should have public network access disabled
Disabling public network access improves security by ensuring that Cognitive Services account isn't exposed on the public internet. Creating private endpoints can limit exposure of Cognitive Services account.
What this control checks
Checks the public network access setting on Cognitive Services accounts
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 2.2.1.1 Ensure public network access is Disabled
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cognitive_account_public_network_access_disabled - Checkov Check:
CKV_AZURE_134 - Powerpipe Control:
azure_compliance.control.cognitive_account_public_network_access_disabled - Prowler Check:
aiservices_account_public_network_access_disabled - Azure Policy Definition:
47ba1dd7-28d9-4b07-a8d5-9813bed64e0c
Last reviewed: 2026-10-11