Synapse workspaces should have data exfiltration protection enabled
This control checks whether Synapse workspace has data exfiltration protection enabled. Azure Policy describes allowing outbound data traffic only to approved targets. This helps prevention against data exfiltration by validating the target before sending data.
Increase security of your Synapse workspace by allowing outbound data traffic only to approved targets. This helps prevention against data exfiltration by validating the target before sending data.
What this control checks
Synapse workspace must have preventDataExfiltration set to true in managedVirtualNetworkSettings
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Synapse workspaces should allow outbound data traffic only to approved targets" (3484ce98-c0c5-4c83-994b-c5ac24785218); PowerPipe control azure_compliance.control.synapse_workspace_data_exfiltration_protection_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_157.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
synapse_workspace_data_exfiltration_protection_enabled - Checkov Check:
CKV_AZURE_157 - Powerpipe Control:
azure_compliance.control.synapse_workspace_data_exfiltration_protection_enabled - Azure Policy Definition:
3484ce98-c0c5-4c83-994b-c5ac24785218
Last reviewed: 2026-10-15