Back to Checks
azure

Storage account has 'Public Network Access' disabled

storage_account_public_network_access_disabled
Service: storageSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:microsoft.storage/storageaccounts

Azure Storage accounts with public network access disabled cannot be reached from public networks. Setting publicNetworkAccess to Disabled overrides the public access settings of individual containers and forces access through private endpoints or trusted services. This is independent from the 'Allow Blob Anonymous Access' setting.

Prowler logoProwlerprowler-provider-azure

Risk

Leaving public network access enabled exposes the storage account endpoints to the public Internet, widening the attack surface and undermining defense in depth.

This increases the risk of unauthorized access, data exfiltration, and reconnaissance against the account, especially when combined with weak network rules or overly permissive access policies.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks storage_account_public_network_access_disabled

Recommendation

Disable public network access on the storage account and reach it through private endpoints or trusted Azure services only. Combine this with least privilege RBAC, short-lived SAS tokens, and network restrictions. Validate client connectivity before disabling public access in production.

Remediation

CLI

az storage account update --name <storage-account> --resource-group <resource-group> --public-network-access Disabled

Terraform

resource "azurerm_storage_account" "<example_resource_name>" {
  name                          = "<example_resource_name>"
  resource_group_name           = "<example_resource_name>"
  location                      = "<example_location>"
  account_tier                  = "Standard"
  account_replication_type      = "LRS"
  public_network_access_enabled = false # Critical: disables public network access
}

NativeIaC

// Storage account with public network access disabled
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  kind: 'StorageV2'
  sku: { name: 'Standard_LRS' }
  properties: {
    publicNetworkAccess: 'Disabled' // Critical: disables public network access to the account
  }
}

Other

1In the Azure portal, go to Storage accounts and select the target account
2Under Security + networking, click Networking
3Set Public network access to Disabled
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.storage.storage_client import storage_client


class storage_account_public_network_access_disabled(Check):
    """
    Ensure that 'Public Network Access' is 'Disabled' for storage accounts.

    This check evaluates the storage account's publicNetworkAccess property, which controls
    whether the account is reachable from public networks. It is independent from the
    'Allow Blob Anonymous Access' setting (covered by
    storage_blob_public_access_level_is_disabled).
    - PASS: The storage account has public network access disabled.
    - FAIL: The storage account has public network access enabled (or unset, which Azure treats as enabled).
    """

    def execute(self) -> list[Check_Report_Azure]:
        findings = []
        for subscription, storage_accounts in storage_client.storage_accounts.items():
            subscription_name = storage_client.subscriptions.get(
                subscription, subscription
            )
            for storage_account in storage_accounts:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=storage_account
                )
                report.subscription = subscription

                if storage_account.public_network_access == "Disabled":
                    report.status = "PASS"
                    report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has public network access disabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Storage account {storage_account.name} from subscription {subscription_name} ({subscription}) has public network access enabled."

                findings.append(report)

        return findings

References