Azure Compliance ControlsAzure Storage
Storage accounts should have public network access disabled
Checks whether storage accounts in the environment have public network access turned off. The control is concerned with the `public network access` state of storage accounts and whether that access is disabled, rather than left open to the public network.
What this control checks
Storage accounts block public network access, so they are reachable only through private routes
Framework mappings
The clauses this control is mapped to in each framework.
- 2.2.1.1 Ensure public network access is Disabled
- 10.3.2.2 Ensure that 'Public Network Access' is 'Disabled' for storage accounts
- 9.3.2.2 Ensure that 'Public Network Access' is 'Disabled' for storage accounts
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_public_network_access_disabled - Powerpipe Control:
azure_compliance.control.storage_account_public_network_access_disabled - Azure Policy Definitions:
a06d0189-92e8-4dba-b0c4-08d7669fce7d,b2982f36-99f2-4db5-8eff-283140c09693
Last reviewed: 2026-10-15