Storage accounts should have public network access disabled
Checks whether storage accounts in the environment have public network access turned off. The control is concerned with the `public network access` state of storage accounts and whether that access is disabled, rather than left open to the public network.
What this control checks
Storage accounts block public network access, so they are reachable only through private routes
Common pitfalls
Disabling denies IP and virtual network rule logins
This option disables access from any public address space outside the Azure IP range, and denies all logins that match IP or virtual network-based firewall rules.
Audit effect is the default
The effect parameter allows Audit, Deny or Disabled. The defaultValue is Audit.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Configure storage accounts to disable public network access" (a06d0189-92e8-4dba-b0c4-08d7669fce7d) and "Storage accounts should disable public network access" (b2982f36-99f2-4db5-8eff-283140c09693); PowerPipe control azure_compliance.control.storage_account_public_network_access_disabled.
Framework-specific interpretation
CIS Azure Benchmark v4.0.0: Mapped to 10.3.2.2 (Ensure that 'Public Network Access' is 'Disabled' for storage accounts) and 2.2.1.1 (Ensure public network access is Disabled).
CIS Azure Benchmark v5.0.0: Mapped to 9.3.2.2 (Ensure that 'Public Network Access' is 'Disabled' for storage accounts).
Framework mappings
The clauses this control is mapped to in each framework.
- 2.2.1.1 Ensure public network access is Disabled
- 10.3.2.2 Ensure that 'Public Network Access' is 'Disabled' for storage accounts
- 9.3.2.2 Ensure that 'Public Network Access' is 'Disabled' for storage accounts
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_public_network_access_disabled - Powerpipe Control:
azure_compliance.control.storage_account_public_network_access_disabled - Azure Policy Definitions:
a06d0189-92e8-4dba-b0c4-08d7669fce7d,b2982f36-99f2-4db5-8eff-283140c09693
Last reviewed: 2026-10-15