Azure Compliance ControlsFoundry Tools
Cognitive Services accounts should have network access restrictions configured
The `cognitive_account_restrict_public_access` control applies to Azure Cognitive Services accounts and their network access settings. Access to an account can be granted to specific Azure virtual networks or to public internet IP address ranges.
What this control checks
Cognitive Services accounts must restrict network access to allowed networks only.
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 2.2.1.2 Ensure Network Access Rules are set to Deny-by-default
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- SC.L2-3.13.6 Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception)
Related controls
- Cognitive Services accounts should have local authentication methods disabled
- Storage accounts should have the default network access rule set to deny
- Kubernetes clusters should have public access restrictions configured
- Azure SQL databases should have public network access disabled
- Azure Event Grid domains should use private link
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cognitive_account_restrict_public_access - Powerpipe Control:
azure_compliance.control.cognitive_account_restrict_public_access - Prowler Checks:
aiservices_account_network_acls_default_action_deny,aiservices_account_public_network_access_disabled - Azure Policy Definition:
037eea7a-bd0a-46c5-9a66-03aea78705d3
Last reviewed: 2026-10-11