Service Bus namespaces should not allow overly permissive network access
Checks Azure Service Bus namespaces for network access settings that permit broad connectivity. Each namespace is evaluated, and those whose network access configuration is overly permissive, rather than restricted to specific sources, are reported as failing.
Disabling public network access improves security by ensuring that the resource isn't exposed on the public internet. By default, Service Bus namespaces are accessible from the internet as long as the request comes with valid authentication and authorization.
What this control checks
Service Bus namespaces are checked for network access settings that are too permissive
Common pitfalls
Namespaces are accessible from the internet by default
By default, Service Bus namespaces are accessible from the internet as long as the request comes with valid authentication and authorization.
Only Disabled passes the policy
The policy flags a resource when publicNetworkAccess is not equal to Disabled.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Service Bus Namespaces should disable public network access" (cbd11fd3-3002-4907-b6c8-579f0e700e13); PowerPipe control azure_compliance.control.servicebus_namespace_no_overly_permissive_network_access.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_204.
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 2.2.1.2 (Ensure Network Access Rules are set to Deny-by-default).
Framework mappings
The clauses this control is mapped to in each framework.
- 2.2.1.2 Ensure Network Access Rules are set to Deny-by-default
Related controls
- Storage accounts should use virtual network rules to restrict network access
- Key vaults should have public network access disabled
- PostgreSQL servers should have public network access disabled
- Storage accounts should have network access restrictions configured
- Recovery Services vaults should use private link
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
servicebus_namespace_no_overly_permissive_network_access - Checkov Check:
CKV_AZURE_204 - Powerpipe Control:
azure_compliance.control.servicebus_namespace_no_overly_permissive_network_access - Azure Policy Definition:
cbd11fd3-3002-4907-b6c8-579f0e700e13
Last reviewed: 2026-10-15