cis-azure-compute-15-5

name	cis-azure-compute-15.5
description	Ensure public network access is disabled for Batch accounts
category	cis-azure-compute
version	2.0.0
author	cyberstrike-official
tags	["cis","azure","batch"]
cis_id	15.5
cis_benchmark	CIS Microsoft Azure Compute Services Benchmark v2.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure public network access is disabled for Batch accounts

Description

Disabling public network access ensures all connectivity occurs through private endpoints or approved virtual networks.

Rationale

Public network access exposes Batch accounts to internet threats like DDoS attacks and unauthorized access, violating Zero Trust principles and compliance requirements for secure data processing environments.

Impact

A virtual network or private endpoint should be implemented for the Batch account prior to disabling public network access.

Audit Procedure

Using Azure Portal

1. Login to https://portal.azure.com
2. For each Batch Account, click on the Batch account name
3. Navigate to the Settings drop-down, then click Networking.
4. Under the Public access tab, ensure that Public Network Access is set to Disabled.

Repeat for each Batch account in scope.

Using Azure CLI

az batch account show \
  --name <batch-account-name> \
  --resource-group <resource-group> \
  --query "publicNetworkAccess"

Using Azure PowerShell

(Get-AzBatchAccount -Name "<batch-account-name>").PublicNetworkAccess

Expected Output: Disabled

Expected Result

The publicNetworkAccess setting should be Disabled for all Batch accounts.

Remediation

Using Azure Portal

1. Login to https://portal.azure.com
2. For each Batch Account, click on the Batch account name
3. Navigate to the Settings drop-down, then click Networking.
4. Under the Public access tab, ensure that Public Network Access is set to Disabled.
5. Click Save

Repeat for each Batch account in scope.

Using Azure CLI

az batch account update \
  --name <account-name> \
  --resource-group <rg-name> \
  --public-network-access Disabled

Using Azure PowerShell

Update-AzBatchAccount -Name <account-name> -ResourceGroupName <rg-name> -PublicNetworkAccess Disabled