Azure Compliance ControlsAzure Network Watcher
Network security groups should have flow logs configured
Audit for network security groups to verify if flow logs are configured. Enabling flow logs allows to log information about IP traffic flowing through network security group. It can be used for optimizing network flows, monitoring throughput, and detecting intrusions.
What this control checks
Network security groups must have flow logs configured (flowLogs count not equal to 0).
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- DE.CM-01
- ID.AM-03
- 3.1.g Trails
- 5 Policy for Information System Audit (IS Audit)
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SI.L2-3.14.6 Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks
Related controls
- Azure subscriptions should have a 'Diagnostic Setting' configured for Subscription Activity Logs
- Key vaults should have resource logs enabled
- Network security groups should limit inbound TCP port 3306 access from the internet
- Azure subscriptions should have an Activity Log Alert configured for specific Administrative operations
- MySQL servers should have 'audit_log_events' configured to include 'CONNECTION'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_sg_flowlog_enabled - Powerpipe Controls:
azure_compliance.control.network_sg_flowlog_enabled,azure_compliance.control.network_sg_flowlog_retention_period_greater_than_90 - Azure Policy Definition:
c251913d-7d24-4958-af87-478ed3b9ba41
Last reviewed: 2026-10-14