Azure Compliance ControlsAzure Network Watcher
Regions with newly created virtual networks should have Network Watcher deployed
This policy creates a network watcher resource in regions with virtual networks. You need to ensure existence of a resource group named `networkWatcherRG`, which will be used to deploy network watcher instances.
What this control checks
Network Watcher is deployed in each region that has a newly created virtual network
Framework mappings
The clauses this control is mapped to in each framework.
- 0894.01m2Organizational.7-01.m 01.04 Network Access Control
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
network_watcher_in_regions_with_virtual_network - Powerpipe Control:
azure_compliance.control.network_watcher_in_regions_with_virtual_network - Azure Policy Definition:
a9b99dd8-06c5-4317-8629-9d86a3c6e7d9
Last reviewed: 2026-10-14