Check ID:
Provider: Azure
Service:
Severity: HIGH
Categories:
Resource type:
aisearch_service_not_publicly_accessibleProvider: Azure
Service:
aisearchSeverity: HIGH
Categories:
internet-exposed, gen-aiResource type:
microsoft.search/searchservicesWhat this check verifies
Azure AI Search service limits its data-plane endpoint by disabling public network access. This evaluation checks whether the service only permits connections via private endpoints or narrowly scoped, explicitly allowed sources.Risk
Internet-reachable search endpoints impact CIA:- Confidentiality: unauthorized queries reveal indexed data/metadata
- Integrity: stolen admin/query keys allow index changes or deletions
- Availability: abuse and scanning drive throttling and outages
Recommendation
SetPublic network access: Disabled. Prefer Private Link and restrict any residual exposure to specific sources only. Use least privilege with Microsoft Entra ID RBAC instead of keys. Apply defense in depth with IP rules/trusted services, enable logs, and review access lists regularly.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az search service update —name <service_name> —resource-group <resource_group_name> —public-access disabled
References
- https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/azure-cognitive-search-security-baseline
- https://www.azadvertizer.net/azpolicyadvertizer/9cee519f-d9c1-4fd9-9f79-24ec3449ed30.html
- https://learn.microsoft.com/en-us/azure/search/service-configure-firewall#configure-network-access-in-azure-portal
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = aisearch_service_not_publicly_accessible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks