Azure Compliance ControlsAzure Virtual Network
Network security groups should limit inbound UDP port 138 access from the internet
Checks that network security group rules do not allow unrestricted inbound traffic on UDP port 138. Network security groups provide stateful filtering of inbound and outbound traffic to Azure resources, and Trivy `AZU-0047` flags ingress from any IP address.
What this control checks
A security group rule should not allow unrestricted ingress from any IP address.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_security_group_restrict_inbound_udp_port_138 - Powerpipe Control:
azure_compliance.control.network_security_group_restrict_inbound_udp_port_138 - Trivy Check:
AZU-0047
Last reviewed: 2026-10-13