Back to Checks
azure

AI Search service has public network access disabled

aisearch_service_not_publicly_accessible
Service: aisearchSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedgen-ai
Resource Type:microsoft.search/searchservices

Azure AI Search service limits its data-plane endpoint by disabling public network access. This evaluation checks whether the service only permits connections via private endpoints or narrowly scoped, explicitly allowed sources.

Prowler logoProwlerprowler-provider-azure

Risk

Internet-reachable search endpoints impact CIA:

  • Confidentiality: unauthorized queries reveal indexed data/metadata
  • Integrity: stolen admin/query keys allow index changes or deletions
  • Availability: abuse and scanning drive throttling and outages

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks aisearch_service_not_publicly_accessible

Recommendation

Set Public network access: Disabled. Prefer Private Link and restrict any residual exposure to specific sources only. Use least privilege with Microsoft Entra ID RBAC instead of keys. Apply defense in depth with IP rules/trusted services, enable logs, and review access lists regularly.

Remediation

CLI

az search service update --name <service_name> --resource-group <resource_group_name> --public-access disabled

Terraform

# Disable public network access for Azure AI Search
resource "azurerm_search_service" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<location>"
  sku                 = "basic"

  public_network_access_enabled = false  # CRITICAL: Disables public access to pass the check
}

NativeIaC

// Disable public network access for an Azure AI Search service
resource search 'Microsoft.Search/searchServices@2023-11-01' = {
  name: '<example_resource_name>'
  location: '<location>'
  sku: { name: 'basic' }
  properties: {
    publicNetworkAccess: 'disabled' // CRITICAL: Disables public access so the service is not reachable from the internet
  }
}

Other

1In the Azure portal, open your AI Search service
2Go to Settings > Networking
3Under Public network access, select Disabled
4Click Save
5Wait a few minutes and re-run the check

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.aisearch.aisearch_client import aisearch_client


class aisearch_service_not_publicly_accessible(Check):
    def execute(self) -> List[Check_Report_Azure]:
        findings = []

        for (
            subscription_id,
            aisearch_services,
        ) in aisearch_client.aisearch_services.items():
            subscription_name = aisearch_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for aisearch_service in aisearch_services.values():
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=aisearch_service
                )
                report.subscription = subscription_id
                report.status = "FAIL"
                report.status_extended = f"AISearch Service {aisearch_service.name} from subscription {subscription_name} ({subscription_id}) allows public access."

                if not aisearch_service.public_network_access:
                    report.status = "PASS"
                    report.status_extended = f"AISearch Service {aisearch_service.name} from subscription {subscription_name} ({subscription_id}) does not allows public access."

                findings.append(report)

        return findings

References