Azure Synapse workspaces should use private link

Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination. By mapping private endpoints to Azure Synapse workspace, data leakage risks are reduced.

By mapping private endpoints to Azure Synapse workspace, data leakage risks are reduced.

What this control checks

Synapse workspace needs at least one private endpoint connection with status Approved.

Common pitfalls

Only Approved connections count

The policy counts privateEndpointConnections where privateLinkServiceConnectionState.status equals Approved. The effect applies when that count is less than 1.

Audit evidence

Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Synapse workspaces should use private link" (72d11df1-dd8a-41f7-8925-b05b960ebafc); PowerPipe control azure_compliance.control.synapse_workspace_private_link_used.

Framework-specific interpretation

NIST SP 800-53 Rev 5: Mapped to AC-17 (Remote Access), AC-17(1) (Monitoring and Control), AC-4 (Information Flow Enforcement) and 2 more clauses.

FedRAMP Moderate Baseline Rev 4: Mapped to AC-17 (Remote Access), AC-17(1) (Automated Monitoring/Control), AC-4 (Information Flow Enforcement) and 2 more clauses.

Framework mappings

The clauses this control is mapped to in each framework.

NIST SP 800-53 Rev 5

AC-17 Remote Access
AC-17(1) Monitoring And Control
Information Flow Enforcement (AC-4)
SC-7: Boundary Protection
SC-7(3) Access Points

FedRAMP Moderate Baseline Rev 4

AC-4 Information Flow Enforcement
AC-17 (3): Managed Access Control Points
AC-17(1) Automated Monitoring/Control
SC-7: Boundary Protection
SC-7(3) Access Points

NIST SP 800-171 Rev 2

3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
3.1.3 Control the flow of CUI in accordance with approved authorizations
3.1.12: Monitor and control remote access sessions.
3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
3.1.14 Route remote access via managed access control points

3 more clauses

3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks

CIS Azure Benchmark v4.0.0

2.2.2.1 Ensure Private Endpoints are used to access {service}

CMMC 2.0 Level 2

AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
AC.L2-3.1.12 Monitor and control remote access sessions
AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
AC.L2-3.1.14 Route remote access via managed access control points

3 more clauses

SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems

FedRAMP High

AC-4 Information Flow Enforcement
AC-17 Remote Access
AC-17(1) Automated Monitoring / Control
SC-7 Boundary Protection
SC-7(3) Access Points

Tool mappings

Use these identifiers to cross-reference this control across tools, reports, and evidence.

Compliance.tf Control: synapse_workspace_private_link_used
Powerpipe Control: azure_compliance.control.synapse_workspace_private_link_used
Azure Policy Definition: 72d11df1-dd8a-41f7-8925-b05b960ebafc

Last reviewed: 2026-10-15

View all Azure controls →