cis-azure-foundations-2-1-10

name	cis-azure-foundations-2.1.10
description	Ensure 'Allow Public Network Access' is set to 'Disabled'
category	cis-azure-foundations
version	5.0.0
author	cyberstrike-official
tags	["cis","azure","databricks","analytics"]
cis_id	2.1.10
cis_benchmark	CIS Microsoft Azure Foundations Benchmark v5.0.0
tech_stack	["azure"]
cwe_ids	[]
chains_with	["cis-azure-foundations-2.1.1","cis-azure-foundations-2.1.9","cis-azure-foundations-2.1.11"]
prerequisites	[]
severity_boost	{}

Ensure 'Allow Public Network Access' is set to 'Disabled'

Description

Disable public network access to prevent exposure to the internet and reduce the risk of unauthorized access. Use private endpoints to securely manage access within trusted networks.

Rationale

Disabling public network access improves security by ensuring that Azure Databricks workspaces are not exposed on the public internet.

Impact

NOTE: Prior to disabling public network access, it is strongly recommended that, for each workspace, either:

• Virtual network integration is completed as described in "Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet)"

OR

• Private endpoints/links are set up as described in "Ensure private endpoints are used to access Azure Databricks workspaces."

Disabling public network access restricts access to the service. This enhances security but will require the configuration of a virtual network and/or private endpoints for any services or users needing access within trusted networks.

Before public network access can be disabled, Azure Databricks workspaces must be deployed in a customer-managed virtual network (VNet injection) -- refer to the recommendation Ensure that Azure Databricks is deployed in a customer-managed virtual network (VNet), and requiredNsgRules must be set to a value other than AllRules.

Audit Procedure

Audit from Azure Portal

1. Go to Azure Databricks.
2. Click the name of a workspace.
3. Under Settings click Networking.
4. Under Network access, ensure Allow Public Network Access is set to Disabled.
5. Repeat steps 1-4 for each workspace.

Audit from Azure CLI

Run the following command to list workspaces:

az databricks workspace list

For each workspace, run the following command to get the publicNetworkAccess setting:

az databricks workspace show --resource-group <resource-group> --name <workspace> --query publicNetworkAccess

Ensure that "Disabled" is returned.

Audit from PowerShell

Run the following command to list workspaces:

Get-AzDatabricksWorkspace