Azure Compliance ControlsAzure Disk Storage
Managed disks should not have 'Disk Network Access' set to 'Enable public access from all networks'
Virtual Machine Disks and snapshots can be configured to allow access from different network resources. The powerpipe check asks that 'Disk Network Access' is NOT set to 'Enable public access from all networks'.
What this control checks
'Disk Network Access' must NOT be 'Enable public access from all networks'.
Framework mappings
The clauses this control is mapped to in each framework.
- 2.2.1.2 Ensure Network Access Rules are set to Deny-by-default
- 8.5 Ensure that 'Disk Network Access' is NOT set to 'Enable public access from all networks'
Related controls
- Storage accounts should have 'Allow Blob Anonymous Access' set to 'Disabled'
- Internet-facing virtual machines should use network security groups for protection
- Virtual machines should have all network ports restricted by their associated network security groups
- Network security groups should have SSH access from the internet restricted
- Virtual machines should be protected by Azure Backup
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_disk_public_access_disabled - Powerpipe Control:
azure_compliance.control.compute_disk_public_access_disabled
Last reviewed: 2026-10-11