Azure Compliance ControlsAzure Virtual Network
Network security groups should have HTTP(S) access on ports 80 and 443 from the internet evaluated and restricted
Network security groups should be periodically evaluated for port misconfigurations. Ports and protocols exposed to the Internet should be evaluated for necessity. They should be restricted wherever they are not explicitly required and narrowly configured.
What this control checks
A security group rule should not allow unrestricted ingress from any IP address.
Framework mappings
The clauses this control is mapped to in each framework.
- 8.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted
- 7.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted
- 6.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted
- 7.4 Ensure that HTTP(S) access from the Internet is evaluated and restricted
Related controls
- Network security groups should have RDP access restrictions configured
- Network security groups should have UDP services restricted from the internet
- Network security groups should limit inbound UDP port 53 access from the internet
- Internet-facing virtual machines should use network security groups for protection
- Network security groups should have Diagnostic Settings configured
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_https_port_80_443_access_restricted - Powerpipe Control:
azure_compliance.control.network_security_group_https_port_80_443_access_restricted - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13