Azure Compliance ControlsAzure Network Watcher
Network Watcher flow logs should have traffic analytics enabled
Traffic analytics analyzes flow logs to provide insights into traffic flow in your Azure cloud. It can be used to visualize network activity across your Azure subscriptions and identify hot spots, identify security threats, understand traffic flow patterns, pinpoint network misconfigurations and more.
What this control checks
Network Watcher flow logs must have traffic analytics turned on; logs without it fail
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- DE.CM-01
- ID.AM-03
- 3.1.g Trails
Related controls
- Application gateways should have Web Application Firewall (WAF) enabled
- Network security groups should limit outbound access from the internet
- IoT hubs should have resource logs enabled
- Stream Analytics jobs should have resource logs enabled
- Network security groups should limit inbound TCP port 53 access from the internet
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_watcher_flow_log_traffic_analytics_enabled - Powerpipe Control:
azure_compliance.control.network_watcher_flow_log_traffic_analytics_enabled - Azure Policy Definition:
2f080164-9f4d-497e-9db6-416dc9f7b48a
Last reviewed: 2026-10-14