Azure Compliance ControlsAzure Disk Storage
Disk access resources should use private link
Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. By mapping private endpoints to diskAccesses, data leakage risks are reduced.
What this control checks
Pass or fail check on private link use for disk access resources
Framework mappings
The clauses this control is mapped to in each framework.
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- AC-17 (3): Managed Access Control Points
- AC-17(1) Automated Monitoring/Control
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.1.12: Monitor and control remote access sessions.
- 3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- 3.1.14 Route remote access via managed access control points
3 more clauses
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 2.2.2.1 Ensure Private Endpoints are used to access {service}
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- AC.L2-3.1.12 Monitor and control remote access sessions
- AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- AC.L2-3.1.14 Route remote access via managed access control points
3 more clauses
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- AC-4 Information Flow Enforcement
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
- SC-7 Boundary Protection
- SC-7(3) Access Points
Related controls
- Managed disks should have 'Enable Data Access Authentication Mode' set to 'Checked'
- Azure SignalR Service should use private link
- Storage accounts should use virtual network rules to restrict network access
- Databricks workspaces should have 'Allow Public Network Access' set to 'Disabled'
- Virtual machines should be in an approved virtual network
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_disk_access_uses_private_link - Powerpipe Control:
azure_compliance.control.compute_disk_access_uses_private_link - Azure Policy Definition:
f39f5f49-4abf-44de-8c70-0756997bfb51
Last reviewed: 2026-10-11