Azure Compliance ControlsAzure Virtual Network
Network security groups should limit inbound TCP port 23 access from the internet
Uses Trivy check `AZU-0047` to evaluate network security group rules. The check flags any rule that allows unrestricted ingress from any IP address, so that traffic is not accepted from every source on the internet.
What this control checks
Trivy AZU-0047 says a security group rule should not allow unrestricted ingress from any IP address. Its Terraform example sets a restrictive address prefix, sets an Inbound rule, and sets access to Allow.
Related controls
- Network security groups should limit inbound TCP port 1433 access from the internet
- Network security groups should limit inbound TCP port 445 access from the internet
- Network security groups should have RDP access restrictions configured
- Network security groups should have Diagnostic Settings configured
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_restrict_inbound_tcp_port_23 - Powerpipe Control:
azure_compliance.control.network_security_group_restrict_inbound_tcp_port_23 - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13