Azure Compliance ControlsAzure Container Registry
Container registries should not allow unrestricted network access
Azure container registries by default accept connections over the internet from hosts on any network. Allow access from only specific public IP addresses or address ranges. A registry without an IP/firewall rule or a configured virtual network is unhealthy.
What this control checks
Registry needs an IP/firewall rule or a configured virtual network, else unhealthy
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 2.2.1.2 Ensure Network Access Rules are set to Deny-by-default
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SC-7(3) Access Points
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
container_registry_restrict_public_access - Powerpipe Controls:
azure_compliance.control.container_registry_restrict_public_access,azure_compliance.control.container_registry_use_virtual_service_endpoint
Last reviewed: 2026-10-11