Azure Compliance ControlsAzure Key Vault
Key vaults should use a virtual network service endpoint
This policy audits any Key Vault that is not configured to use a virtual network service endpoint. The Azure Policy definition applies to resources of type `Microsoft.KeyVault/vaults`, and its effect can be set to either `Audit` or `Disabled`.
What this control checks
Key Vault must be configured to use a virtual network service endpoint, or it is audited.
Framework mappings
The clauses this control is mapped to in each framework.
- 0805.01m1Organizational.12-01.m 01.04 Network Access Control
- 0806.01m2Organizational.12356-01.m 01.04 Network Access Control
- 0865.09m2Organizational.13-09.m 09.06 Network Security Management
- 0894.01m2Organizational.7-01.m 01.04 Network Access Control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
keyvault_vault_use_virtual_service_endpoint - Powerpipe Control:
azure_compliance.control.keyvault_vault_use_virtual_service_endpoint - Azure Policy Definition:
ea4d6841-2173-4317-9747-ff522a45120f
Last reviewed: 2026-10-13