Azure Compliance ControlsAzure Virtual Network
Virtual machines should have management ports closed
Open remote management ports are exposing your VM to a high level of risk from Internet-based attacks. These attacks attempt to brute force credentials to gain admin access to the machine. The check is titled "Management ports should be closed on your virtual machines".
What this control checks
Management ports should be closed on your virtual machines
Framework mappings
The clauses this control is mapped to in each framework.
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 1.1 IT Governance
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SC-7(3) Access Points
- 1143.01c1System.123-01.c 01.02 Authorized Access to Information Systems
- 1150.01c2System.10-01.c 01.02 Authorized Access to Information Systems
- 1193.01l2Organizational.13-01.l 01.04 Network Access Control
Related controls
- Network security groups should limit inbound TCP port 5900 access from the internet
- Network security groups should limit inbound TCP port 5500 access from the internet
- Network security groups should limit inbound ICMP port access from the internet
- Network security groups should limit inbound UDP port 53 access from the internet
- Flow log resources should have flow logging enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_remote_access_restricted - Powerpipe Control:
azure_compliance.control.network_security_group_remote_access_restricted
Last reviewed: 2026-10-13