AZ-017 Microsoft Azure

Key Vault network access is restricted (firewall / private endpoint).

Key Vault network access is restricted (firewall / private endpoint).

Domain
Microsoft Azure
Area
Key Vault
Automated / manual
Automated

Risk if it fails

Public vaults broaden secret exposure.

A vault reachable from anywhere means a stolen token can be used globally to pull every password and key your applications rely on.

How Tess tests it

1 test — each concludes only on cited evidence.

Key Vault network access is restricted (firewall / private endpoint).

Automated
Procedure
Confirm networkAcls defaultAction=Deny.

Read-only command 

az keyvault list --query '[].{Name:name,Default:properties.networkAcls.defaultAction}' -o table

More in Microsoft Azure

AZ-001 MFA is enforced for all users, especially privileged roles. AZ-002 Number of Global Administrators is limited (typically 2-4). AZ-003 Privileged Identity Management (PIM) provides just-in-time elevation. AZ-004 Legacy/basic authentication is blocked.

Want Tess to test AZ-017 against your evidence?

Book a demo