Azure File Sync should use private link

Azure File Sync should use private link. Creating a private endpoint for the indicated Storage Sync Service resource allows you to address it from within the private IP address space of your organization's network.

Creating a private endpoint for the indicated Storage Sync Service resource allows you to address your Storage Sync Service resource from within the private IP address space of your organization's network, rather than through the internet-accessible public endpoint.

What this control checks

Azure File Sync should use private link to connect to the Storage Sync Service

Common pitfalls

Private endpoint does not disable public endpoint

Creating a private endpoint by itself does not disable the public endpoint.

Audit evidence

Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.storage_sync_private_link_used.

Framework-specific interpretation

NIST SP 800-53 Rev 5: Mapped to AC-17 (Remote Access), AC-17(1) (Monitoring and Control), AC-4 (Information Flow Enforcement) and 2 more clauses.

Framework mappings

The clauses this control is mapped to in each framework.

NIST SP 800-53 Rev 5

AC-17 Remote Access
AC-17(1) Monitoring And Control
Information Flow Enforcement (AC-4)
SC-7: Boundary Protection
SC-7(3) Access Points

NIST SP 800-171 Rev 2

3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
3.1.3 Control the flow of CUI in accordance with approved authorizations
3.1.12: Monitor and control remote access sessions.
3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
3.1.14 Route remote access via managed access control points

3 more clauses

3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks

CIS Azure Benchmark v4.0.0