Recovery Services vaults should use private link
Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. By mapping private endpoints to Azure Recovery Services vaults, data leakage risks are reduced.
What this control checks
Azure Policy check 11e3da8c-1d68-4392-badd-0ff3c43ab5b0 looks at Microsoft.RecoveryServices/vaults and audits when fewer than 1 privateEndpointConnections has privateLinkServiceConnectionState.status equal to Approved, provisioningState equal to Succeeded and an id containing SiteRecovery. Powerpipe check recovery_service_vault_uses_private_link reports ok when private_endpoint_state_for_site_recovery is Enabled, otherwise alarm.
Framework mappings
The clauses this control is mapped to in each framework.
- 2.2.2.1 Ensure Private Endpoints are used to access {service}
- 6 Business Continuity Planning (BCP) and Disaster Recovery
- 6.4 Recovery strategy / Contingency Plan
Related controls
- Azure SQL databases should have private endpoint connections enabled
- IoT Hub device provisioning service instances should use private link
- Storage accounts should have public network access disabled
- Managed disks should not have 'Disk Network Access' set to 'Enable public access from all networks'
- Storage accounts should have soft delete enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
recovery_service_vault_uses_private_link - Powerpipe Control:
azure_compliance.control.recovery_service_vault_uses_private_link - Azure Policy Definition:
11e3da8c-1d68-4392-badd-0ff3c43ab5b0
Last reviewed: 2026-10-14