Azure Compliance ControlsAzure Virtual Network
Network security groups should limit inbound TCP port 53 access from the internet
Network security group provide stateful filtering of inbound/outbound network traffic to Azure resources. It is recommended that no network security group allows unrestricted inbound access to TCP port 53.
What this control checks
Network security groups must not allow unrestricted inbound TCP port 53 access from the internet.
Related controls
- Network security groups should have HTTP(S) access from the internet evaluated and restricted
- Network security groups should have Diagnostic Settings configured
- Azure subscriptions should have an Activity Log Alert configured for Create or Update Network Security Group
- Azure subscriptions should have an Activity Log Alert configured for Delete Network Security Group
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_restrict_inbound_tcp_port_53 - Powerpipe Control:
azure_compliance.control.network_security_group_restrict_inbound_tcp_port_53 - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13