Azure Compliance ControlsAzure Key Vault
Key vaults should have a firewall enabled
Azure Key Vault should have firewall enabled. Enable the key vault firewall so that the key vault is not accessible by default to any public IPs. Optionally, you can configure specific IP ranges to limit access to those networks.
What this control checks
Checks whether each key vault has its firewall enabled
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
NIST Cybersecurity Framework v2.0
- RC.RP-03: The integrity of backups and other restoration assets is verified before using them for restoration.
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 3.1.h Public Key Infrastructure (PKI)
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SC-7(3) Access Points
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_firewall_enabled - Powerpipe Control:
azure_compliance.control.keyvault_firewall_enabled
Last reviewed: 2026-10-13