Azure Compliance ControlsAzure Recovery Services
Azure Recovery Services vaults should use private link for backup
Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. By mapping private endpoints to Azure Recovery Services vaults, data leakage risks are reduced.
What this control checks
Passes when the value is Enabled; any other value raises an alarm
Framework mappings
The clauses this control is mapped to in each framework.
- 6 Business Continuity Planning (BCP) and Disaster Recovery
- 6.2 Recovery strategy / Contingency Plan
- 6.3 Backup and Recovery
- 6.4 Recovery strategy / Contingency Plan
Related controls
- Azure SQL databases should have public network access disabled
- Virtual machines should be protected by Azure Backup
- Data factories should have public network access disabled
- Azure Cache for Redis should be in a virtual network
- Cognitive Services accounts should have network access restrictions configured
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
recovery_service_vault_uses_private_link_for_backup - Powerpipe Control:
azure_compliance.control.recovery_service_vault_uses_private_link_for_backup - Azure Policy Definition:
deeddb44-9f94-4903-9fa0-081d524406e3
Last reviewed: 2026-10-14