Azure Compliance ControlsAzure Key Vault
Key vaults should have public network access disabled
Disable public network access for your key vault so that it's not accessible over the public internet. This can reduce data leakage risks. The Azure Policy check looks at the vault property `publicNetworkAccess`.
What this control checks
Passes if a key vault has public network access disabled, fails if it is enabled
Framework mappings
The clauses this control is mapped to in each framework.
- 2.2.1.1 Ensure public network access is Disabled
- 9.3.7 Ensure that Public Network Access when using Private Endpoint is disabled
- 8.3.7 Ensure Public Network Access is Disabled
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- CRY-10.01AC For the secure storage of cryptographic keys, the cloud service provider uses a suitable software or hardware security module.
- CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- PS-03.02B The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
1 more clause
- PSS-07.02B The cloud service provider distributes credentials using additional security mechanisms to verify the identity of the recipient (e.g. multi-factor authentication), validate the request and protect the credentials.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_vault_public_network_access_disabled - Powerpipe Controls:
azure_compliance.control.keyvault_vault_private_link_used,azure_compliance.control.keyvault_vault_public_network_access_disabled,azure_compliance.control.keyvault_vault_use_virtual_service_endpoint - Prowler Check:
keyvault_access_only_through_private_endpoints - Azure Policy Definitions:
405c5871-3e91-4644-8a63-58e19d68ff5b,55615ac9-af46-4a59-874e-391cc3dfb490,ac673a9a-f77d-4846-b2d8-a57f8e1c01dc - Trivy Check:
AZU-0013
Last reviewed: 2026-10-13