Azure Compliance ControlsAzure Virtual Network
Network security groups should limit inbound TCP port 20 access from the internet
Network security group provide stateful filtering of inbound/outbound network traffic to Azure resources. It is recommended that no network security group allows unrestricted inbound access to TCP port 20.
What this control checks
Trivy AZU-0047 says to set a more restrictive cidr range, such as 10.0.0.0/16 for destination_address_prefix. Trivy AZU-0047 shows an allowed rule using source_address_prefix of a single public IP, 168.63.129.16.
Related controls
- Network security groups should have HTTP(S) access from the internet evaluated and restricted
- Network security groups should have flow logs configured
- Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group
- Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group Rule
- Regions with newly created virtual networks should have Network Watcher deployed
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_restrict_inbound_tcp_port_20 - Powerpipe Control:
azure_compliance.control.network_security_group_restrict_inbound_tcp_port_20 - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13