Audit Public Network Access

Azure BuiltIn Policy Initiative (PolicySet)

Policy types

Policy states

Policy categories

Total Policies: 34
Builtin Policies: 34
Static Policies: 0

GA: 34

25 categories:

App Configuration: 1
App Service: 1
Attestation: 1
Automation: 1
Azure Arc: 1
Azure Databricks: 1
Batch: 1
Bot Service: 1
Cache: 1
Compute: 1
Container Registry: 1
Cosmos DB: 1
Data Factory: 1
Event Grid: 2
Internet of Things: 2
Key Vault: 1
Machine Learning: 1
Monitoring: 3
Search: 1
Service Bus: 1
SignalR: 1
SQL: 6
Storage: 1
Synapse: 1
Web PubSub: 1

Rows: 1-10 / 34

Records:

Use the filters above each column to filter and limit table data. Advanced searches can be performed by using the following operators:
<, <=, >, >=, =, *, !, {, }, ||,&&, [empty], [nonempty], rgx:
Learn more

TableFilter v0.7.3

https://www.tablefilter.com/
©2015-2025 Max Guglielmi

Page of 4

Policy DisplayName

Policy Id

Category

Version

Versioning

Effect

Roles#

Roles

State

policy in AzUSGov

App Configuration should disable public network access

3d9f5e4c-9947-4579-9539-2a7695fbc187

App Configuration

1.0.0

1x
1.0.0

Default
Audit
Allowed
Audit, Deny, Disabled

unknown

App Service Environment apps should not be reachable over public internet

2d048aca-6479-4923-88f5-e2ac295d9af3

App Service

3.0.0

1x
3.0.0

Default
Audit
Allowed
Audit, Deny, Disabled

unknown

Application Insights components should block log ingestion and querying from public networks

1bc02227-0cb6-4e11-8f53-eb0b22eab7e8

Monitoring

1.1.0

1x
1.1.0

Default
Audit
Allowed
audit, Audit, deny, Deny, disabled, Disabled

unknown

Automation accounts should disable public network access

955a914f-bf86-4f0e-acd5-e0766b0efcb6

Automation

1.0.0

1x
1.0.0

Default
Audit
Allowed
Audit, Deny, Disabled

unknown

Azure AI Search services should disable public network access

ee980b6d-0eca-4501-8d54-f6290fd512c3

1.0.1

2x
1.0.1, 1.0.0

Default
Audit
Allowed
Audit, Deny, Disabled

true

Azure Arc Private Link Scopes should disable public network access

898f2439-3333-4713-af25-f1d78bc50556

Azure Arc

1.0.0

1x
1.0.0

Default
Audit
Allowed
Audit, Deny, Disabled

unknown

Azure Attestation providers should disable public network access

5e7e928c-8693-4a23-9bf3-1c77b9a8fe97

Attestation

1.0.0

1x
1.0.0

Default
Audit
Allowed
Audit, Deny, Disabled

unknown

Azure Cache for Redis should disable public network access

470baccb-7e51-4549-8b1a-3e5be069f663

Cache

1.0.0

1x
1.0.0

Default
Audit
Allowed
Audit, Deny, Disabled

unknown

Azure Cosmos DB should disable public network access

797b37f7-06b8-444c-b1ad-fc62867f335a

Cosmos DB

1.0.0

1x
1.0.0

Default
Audit
Allowed
Audit, Deny, Disabled

true

Azure Databricks Workspaces should disable public network access

0e7849de-b939-4c50-ab48-fc6b0f5eeba2

Azure Databricks

1.0.1

1x
1.0.1

Default
Audit
Allowed
Audit, Deny, Disabled

true

Date/Time (UTC ymd) (i)

Changes

2025-06-09 17:23:47

Version change: '4.2.0' to '4.3.0'
remove Policy [Deprecated]: Azure Media Services accounts should disable public network access (8bfe3603-0888-404a-87ff-5c1b6b4cc5e3)

2024-04-11 17:47:35

Version change: '4.1.0' to '4.2.0'
remove Policy [Deprecated]: Cognitive Services accounts should disable public network access (0725b4dd-7e76-479c-a735-68e7ee23d5ca)

2023-04-06 17:42:17

Version change: '4.0.0' to '4.1.0'

2022-08-18 16:32:47

add Policy Azure Databricks Workspaces should disable public network access (0e7849de-b939-4c50-ab48-fc6b0f5eeba2)
add Policy Service Bus Namespaces should disable public network access (cbd11fd3-3002-4907-b6c8-579f0e700e13)
Version change: '3.0.0' to '4.0.0'

2022-07-27 16:33:05

add Policy App Service Environment apps should not be reachable over public internet (2d048aca-6479-4923-88f5-e2ac295d9af3)
add Policy Managed disks should disable public network access (8405fdab-1faf-48aa-b702-999c9c172094)
add Policy Azure Key Vault should disable public network access (405c5871-3e91-4644-8a63-58e19d68ff5b)
add Policy Azure Monitor Private Link Scope should block access to non private link resources (a499fed8-bcc8-4195-b154-641f14743757)
Version change: '2.0.0' to '3.0.0'

2022-06-21 16:34:04

Name change: 'Audit Public Network Access Initiative' to 'Audit Public Network Access'

2022-06-16 16:34:43

2022-04-28 17:39:07

add Initiative f1535064-3294-48fa-94e2-6e83095a5c08

{

displayName: "Audit Public Network Access",
policyType: "BuiltIn",
description: "Audit Azure resources that allow access from the public internet",
metadata: {2 items
- version: "4.3.0",
- category: "SDN"
},
version: "4.3.0",
parameters: {36 items
- Effect-Microsoft.AppConfiguration-configurationStores: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.AppConfiguration/configurationStores Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-AppServiceEnvironment: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.Web/hostingEnvironments Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.Attestation-attestationProviders: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.Attestation/attestationProviders Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.Automation-automationAccounts: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.Automation/automationAccounts Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.Batch-batchAccounts: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.Batch/batchAccounts Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.BotService-botServices: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.BotService/botServices Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.Cache-Redis: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.Cache/Redis Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.CognitiveServices-accounts: {4 items
  - type: "String",
  - metadata: {3 items
    - displayName: "[Deprecated]: Microsoft.CognitiveServices/accounts Effect",
    - description: "Set an effect for this resource type",
    - deprecated: true
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Disabled"
  },
- Effect-Microsoft.Compute-disks: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.Compute/disks Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [2 items
    - "Audit",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.ContainerRegistry-registries: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.ContainerRegistry/registries Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.DataFactory-factories: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.DataFactory/factories Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.DBforMariaDB-servers: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.DBforMariaDB/servers Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.DBforMySQL-flexibleServers: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "DBforMySQL/flexibleServers Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.DBforMySQL-servers: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "DBforMySQL/servers Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.DBforPostgreSQL-flexibleServers: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "DBforPostgreSQL/flexibleServers Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.DBforPostgreSQL-servers: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "DBforPostgreSQL/servers Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.Databricks-workspaces: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.Databricks/workspaces Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.Devices-IotHubs: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.Devices/IotHubs Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.Devices-IotHubProvisioningService: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.Devices/provisioningServices Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.KeyVault-vaults: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.KeyVault/vaults Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.DocumentDB-databaseAccounts: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.DocumentDB/databaseAccounts Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.EventGrid-domains: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.EventGrid/domains Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.EventGrid-topics: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.EventGrid/topics Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.HybridCompute-privateLinkScopes: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.HybridCompute/privateLinkScopes Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.Insights-applicationInsights: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.Insights/components Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-AzureMonitorPrivateLinkScopes: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.Insights/privateLinkScopes Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.MachineLearningServices-workspaces: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.MachineLearningServices/workspaces Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.Media-mediaServices: {4 items
  - type: "String",
  - metadata: {3 items
    - displayName: "[Deprecated]: Microsoft.Media/mediaservices Effect",
    - description: "Set an effect for this resource type",
    - deprecated: true
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Disabled"
  },
- Effect-Microsoft.OperationalInsights-LogAnalytics: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.OperationalInsights/workspaces Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.Search-searchServices: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.Search/searchServices Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.ServiceBus-namespaces: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.Storage/namespaces Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.SignalRService-SignalR: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.SignalRService/webPubSub Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.SignalRService-webPubSub: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.SignalRService/webPubSub Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.SQL-servers: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.SQL/servers Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.Storage-storageAccounts: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.Storage/storageAccounts Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  },
- Effect-Microsoft.Synapse-workspaces: {4 items
  - type: "String",
  - metadata: {2 items
    - displayName: "Microsoft.Synapse/workspaces Effect",
    - description: "Set an effect for this resource type"
    },
  - allowedValues: [3 items
    - "Audit",
    - "Deny",
    - "Disabled"
    ],
  - defaultValue: "Audit"
  }
},
policyDefinitions: [34 items
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftAppConfiguration",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/3d9f5e4c-9947-4579-9539-2a7695fbc187 App Configuration should disable public network access ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.AppConfiguration-configurationStores')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftAppServiceEnvironment",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/2d048aca-6479-4923-88f5-e2ac295d9af3 App Service Environment apps should not be reachable over public internet ,
  - definitionVersion: 3.*.*3.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-AppServiceEnvironment')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftAttestationProviders",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/5e7e928c-8693-4a23-9bf3-1c77b9a8fe97 Azure Attestation providers should disable public network access ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.Attestation-attestationProviders')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftAutomationAccounts",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/955a914f-bf86-4f0e-acd5-e0766b0efcb6 Automation accounts should disable public network access ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.Automation-automationAccounts')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftBatchAccounts",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/74c5a0ae-5e48-4738-b093-65e23a060488 Public network access should be disabled for Batch accounts ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.Batch-batchAccounts')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftBotService",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/5e8168db-69e3-4beb-9822-57cb59202a9d Bot Service should have public network access disabled ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.BotService-botServices')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftCacheRedis",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/470baccb-7e51-4549-8b1a-3e5be069f663 Azure Cache for Redis should disable public network access ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.Cache-Redis')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftContainerRegistry",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/0fdf0491-d080-4575-b627-ad0e843cba0f Public network access should be disabled for Container registries ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.ContainerRegistry-registries')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftComputeDisks",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/8405fdab-1faf-48aa-b702-999c9c172094 Managed disks should disable public network access ,
  - definitionVersion: 2.*.*2.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.Compute-disks')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftDataFactory",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/1cf164be-6819-4a50-b8fa-4bcaa4f98fb6 Public network access on Azure Data Factory should be disabled ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.DataFactory-factories')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMariaDBServers",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/fdccbe47-f3e3-4213-ad5d-ea459b2fa077 Public network access should be disabled for MariaDB servers ,
  - definitionVersion: 2.*.*2.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.DBforMariaDB-servers')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMySQLDBFlexibleServers",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/c9299215-ae47-4f50-9c54-8a392f68a052 Public network access should be disabled for MySQL flexible servers ,
  - definitionVersion: 2.*.*2.3.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.DBforMySQL-flexibleServers')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMySQLDBServers",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/d9844e8a-1437-4aeb-a32c-0c992f056095 Public network access should be disabled for MySQL servers ,
  - definitionVersion: 2.*.*2.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.DBforMySQL-servers')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForPostgreSQLFlexibleServers",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/5e1de0e3-42cb-4ebc-a86d-61d0c619ca48 Public network access should be disabled for PostgreSQL flexible servers ,
  - definitionVersion: 3.*.*3.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.DBforPostgreSQL-flexibleServers')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForPostgreSQLServers",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/b52376f7-9612-48a1-81cd-1ffe4b61032c Public network access should be disabled for PostgreSQL servers ,
  - definitionVersion: 2.*.*2.0.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.DBforPostgreSQL-servers')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForAzureDatabricks",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/0e7849de-b939-4c50-ab48-fc6b0f5eeba2 Azure Databricks Workspaces should disable public network access ,
  - definitionVersion: 1.*.*1.0.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.Databricks-workspaces')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftIoTHubs",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/2d6830fb-07eb-48e7-8c4d-2a442b35f0fb Public network access on Azure IoT Hub should be disabled ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.Devices-IotHubs')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftIoTHubProvisioningService",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/d82101f3-f3ce-4fc5-8708-4c09f4009546 IoT Hub device provisioning service instances should disable public network access ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.Devices-IotHubProvisioningService')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftDocumentDB",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/797b37f7-06b8-444c-b1ad-fc62867f335a Azure Cosmos DB should disable public network access ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.DocumentDB-databaseAccounts')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftEventGridDomains",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/f8f774be-6aee-492a-9e29-486ef81f3a68 Azure Event Grid domains should disable public network access ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.EventGrid-domains')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftEventGridTopics",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/1adadefe-5f21-44f7-b931-a59b54ccdb45 Azure Event Grid topics should disable public network access ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.EventGrid-topics')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftHybridComputePrivateLinkScopes",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/898f2439-3333-4713-af25-f1d78bc50556 Azure Arc Private Link Scopes should disable public network access ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.HybridCompute-privateLinkScopes')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForAzureKeyVault",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/405c5871-3e91-4644-8a63-58e19d68ff5b Azure Key Vault should disable public network access ,
  - definitionVersion: 1.*.*1.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.KeyVault-vaults')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftApplicationInsights",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/1bc02227-0cb6-4e11-8f53-eb0b22eab7e8 Application Insights components should block log ingestion and querying from public networks ,
  - definitionVersion: 1.*.*1.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.Insights-applicationInsights')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftMachineLearningServices",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/438c38d2-3772-465a-a9cc-7a6666a275ce Azure Machine Learning Workspaces should disable public network access ,
  - definitionVersion: 2.*.*2.0.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.MachineLearningServices-workspaces')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForAzureMonitorPrivateLinkScopes",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/a499fed8-bcc8-4195-b154-641f14743757 Azure Monitor Private Link Scope should block access to non private link resources ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-AzureMonitorPrivateLinkScopes')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftLogAnalytics",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/6c53d030-cc64-46f0-906d-2bc061cd1334 Log Analytics workspaces should block log ingestion and querying from public networks ,
  - definitionVersion: 1.*.*1.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.OperationalInsights-LogAnalytics')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftSearchServices",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/ee980b6d-0eca-4501-8d54-f6290fd512c3 Azure AI Search services should disable public network access ,
  - definitionVersion: 1.*.*1.0.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.Search-searchServices')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftServiceBus",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/cbd11fd3-3002-4907-b6c8-579f0e700e13 Service Bus Namespaces should disable public network access ,
  - definitionVersion: 1.*.*1.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.ServiceBus-namespaces')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftSignalR",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/21a9766a-82a5-4747-abb5-650b6dbba6d0 Azure SignalR Service should disable public network access ,
  - definitionVersion: 1.*.*1.2.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.SignalRService-SignalR')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftSignalRWebPubSub",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/bf45113f-264e-4a87-88f9-29ac8a0aca6a Azure Web PubSub Service should disable public network access ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.SignalRService-webPubSub')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftSQLServers",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/1b8ca024-1d5c-4dec-8995-b1a932b41780 Public network access on Azure SQL Database should be disabled ,
  - definitionVersion: 1.*.*1.1.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.SQL-servers')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftStorageAccounts",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/b2982f36-99f2-4db5-8eff-283140c09693 Storage accounts should disable public network access ,
  - definitionVersion: 1.*.*1.0.1,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.Storage-storageAccounts')]"
      }
    }
  },
- {4 items
  - policyDefinitionReferenceId: "AuditPublicNetworkAccessForMicrosoftSynapse",
  - policyDefinitionId: /providers/Microsoft.Authorization/policyDefinitions/38d8df46-cf4e-4073-8e03-48c24b29de0d Azure Synapse workspaces should disable public network access ,
  - definitionVersion: 1.*.*1.0.0,
  - parameters: {1 item
    - effect: {1 item
      - value: "[parameters('Effect-Microsoft.Synapse-workspaces')]"
      }
    }
  }
],
versions: [3 items
- "4.3.0",
- "4.2.0",
- "4.1.0"
]

}