Azure Compliance ControlsAzure Synapse Analytics
Synapse workspaces should have data exfiltration protection enabled
This control checks whether Synapse workspace has data exfiltration protection enabled. Azure Policy describes allowing outbound data traffic only to approved targets. This helps prevention against data exfiltration by validating the target before sending data.
What this control checks
Synapse workspace must have preventDataExfiltration set to true in managedVirtualNetworkSettings
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
synapse_workspace_data_exfiltration_protection_enabled - Checkov Check:
CKV_AZURE_157 - Powerpipe Control:
azure_compliance.control.synapse_workspace_data_exfiltration_protection_enabled - Azure Policy Definition:
3484ce98-c0c5-4c83-994b-c5ac24785218
Last reviewed: 2026-10-15