Cognitive Services accounts should have public network access disabled
Disabling public network access improves security by ensuring that Cognitive Services account isn't exposed on the public internet. Creating private endpoints can limit exposure of Cognitive Services account.
Disable public network access for your Cognitive Services resource so that it's not accessible over the public internet. This can reduce data leakage risks.
What this control checks
Checks the public network access setting on Cognitive Services accounts
Common pitfalls
Conflicting policy effect falls back to audit
The Azure Policy definition uses "conflictEffect": "audit".
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Configure Cognitive Services accounts to disable public network access" (47ba1dd7-28d9-4b07-a8d5-9813bed64e0c); Prowler check aiservices_account_public_network_access_disabled (prowler azure --checks aiservices_account_public_network_access_disabled); PowerPipe control azure_compliance.control.cognitive_account_public_network_access_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_134.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 2.2.1.1 Ensure public network access is Disabled
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cognitive_account_public_network_access_disabled - Checkov Check:
CKV_AZURE_134 - Powerpipe Control:
azure_compliance.control.cognitive_account_public_network_access_disabled - Prowler Check:
aiservices_account_public_network_access_disabled - Azure Policy Definition:
47ba1dd7-28d9-4b07-a8d5-9813bed64e0c
Last reviewed: 2026-10-11