Disk access resources should use private link

Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. By mapping private endpoints to diskAccesses, data leakage risks are reduced.

By mapping private endpoints to diskAccesses, data leakage risks are reduced.

What this control checks

Pass or fail check on private link use for disk access resources

Common pitfalls

Only Approved private endpoint connections pass

It looks for Microsoft.Compute/diskAccesses/privateEndpointConnections where privateLinkServiceConnectionState.status equals Approved.

Effect can be set to Disabled

The effect parameter allows AuditIfNotExists and Disabled. The defaultValue is AuditIfNotExists.

Audit evidence

Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Disk access resources should use private link" (f39f5f49-4abf-44de-8c70-0756997bfb51); PowerPipe control azure_compliance.control.compute_disk_access_uses_private_link.

Framework-specific interpretation

NIST SP 800-53 Rev 5: Mapped to AC-17 (Remote Access), AC-17(1) (Monitoring and Control), AC-4 (Information Flow Enforcement) and 2 more clauses.

FedRAMP Moderate Baseline Rev 4: Mapped to AC-17 (Remote Access), AC-17(1) (Automated Monitoring/Control), AC-4 (Information Flow Enforcement) and 2 more clauses.

Framework mappings

The clauses this control is mapped to in each framework.

NIST SP 800-53 Rev 5

AC-17 Remote Access
AC-17(1) Monitoring And Control
Information Flow Enforcement (AC-4)
SC-7: Boundary Protection
SC-7(3) Access Points

FedRAMP Moderate Baseline Rev 4

AC-4 Information Flow Enforcement
AC-17 (3): Managed Access Control Points
AC-17(1) Automated Monitoring/Control
SC-7: Boundary Protection
SC-7(3) Access Points

NIST SP 800-171 Rev 2

3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
3.1.3 Control the flow of CUI in accordance with approved authorizations
3.1.12: Monitor and control remote access sessions.
3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
3.1.14 Route remote access via managed access control points

3 more clauses

3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks

CIS Azure Benchmark v4.0.0

2.2.2.1 Ensure Private Endpoints are used to access {service}

CMMC 2.0 Level 2

AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
AC.L2-3.1.12 Monitor and control remote access sessions
AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
AC.L2-3.1.14 Route remote access via managed access control points

3 more clauses

SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems

FedRAMP High

AC-4 Information Flow Enforcement
AC-17 Remote Access
AC-17(1) Automated Monitoring / Control
SC-7 Boundary Protection
SC-7(3) Access Points

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf Control: compute_disk_access_uses_private_link
Powerpipe Control: azure_compliance.control.compute_disk_access_uses_private_link
Azure Policy Definition: f39f5f49-4abf-44de-8c70-0756997bfb51

Last reviewed: 2026-10-11

View all Azure controls →