Azure Cognitive Search services should have public network access disabled
Evaluates Azure Cognitive Search services and fails any service where `publicNetworkAccess` is not set to `Disabled`. Creating private endpoints can limit exposure of your Search service by keeping access off the public network.
Disabling public network access improves security by ensuring that your Azure AI Search service is not exposed on the public internet. Internet-reachable search endpoints impact CIA: Confidentiality: unauthorized queries reveal indexed data/metadata. Integrity: stolen admin/query keys allow index changes or deletions.
What this control checks
Azure Cognitive Search services should have public network access disabled
Common pitfalls
Unset argument also fails
KICS flags azurerm_search_service with public_network_access_enabled set to true. KICS also flags azurerm_search_service when public_network_access_enabled is not set.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Configure Azure AI Search services to disable public network access" (9cee519f-d9c1-4fd9-9f79-24ec3449ed30) and "Azure AI Search services should disable public network access" (ee980b6d-0eca-4501-8d54-f6290fd512c3); Prowler check aisearch_service_not_publicly_accessible (prowler azure --checks aisearch_service_not_publicly_accessible); PowerPipe control azure_compliance.control.search_service_public_network_access_disabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_124; KICS query "Azure Cognitive Search Public Network Access Enabled" (4a9e0f00-0765-4f72-a0d4-d31110b78279).
Framework-specific interpretation
PCI DSS v4.0: Mapped to 1.2.8 (Network security controls (NSCs) are configured and maintained.), 1.3.1 (Network access to and from the cardholder data environment is restricted.), 1.3.2 (Network access to and from the cardholder data environment is restricted.) and 2 more clauses.
NIS2 Directive (EU 2022/2555): Mapped to 11.1.1 (For the purpose of Article 21(2), point (i) of Directive (EU) 2022/2555, the relevant entities shall establish...), 11.6.1 (The relevant entities shall implement secure authentication procedures and technologies based on access restrictions...), 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;) and 1 more clause.
NIST SP 800-53 Rev 5: Mapped to AC-4 (Information Flow Enforcement), SC-7 (Boundary Protection) and SC-7(3) (Access Points).
Framework mappings
The clauses this control is mapped to in each framework.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks
- 2 Risk management policy
- 6 Security in network and information systems acquisition, development and maintenance
- 11 Access control
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 3.13.6: Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
- 2.2.1.1 Ensure public network access is Disabled
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- AC-4 Information Flow Enforcement
- SC-7 Boundary Protection
- SC-7(3) Access Points
- 164.312(a)(1) Access control
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
search_service_public_network_access_disabled - Checkov Check:
CKV_AZURE_124 - Powerpipe Control:
azure_compliance.control.search_service_public_network_access_disabled - Prowler Check:
aisearch_service_not_publicly_accessible - Azure Policy Definitions:
9cee519f-d9c1-4fd9-9f79-24ec3449ed30,ee980b6d-0eca-4501-8d54-f6290fd512c3 - KICS Query:
4a9e0f00-0765-4f72-a0d4-d31110b78279
Last reviewed: 2026-10-14