Azure Compliance ControlsAzure Virtual Network
Network security groups should limit inbound ICMP port access from the internet
Network security groups should restrict inbound ICMP port access from internet. Trivy AZU-0047 states that a security group rule should not allow unrestricted ingress from any IP address. Opening ports to the public internet is generally to be avoided.
What this control checks
Its good example sets destination_address_prefix to 10.0.0.0/16. The Powerpipe check network_security_group_restrict_inbound_icmp_port is titled "Network security groups should restrict inbound ICMP port access from internet".
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_restrict_inbound_icmp_port - Powerpipe Control:
azure_compliance.control.network_security_group_restrict_inbound_icmp_port - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13