Key Vault with private endpoints blocks public access

Check ID: keyvault_access_only_through_private_endpoints
Provider: Azure
Service: keyvault
Severity: HIGH
Categories: internet-exposed, trust-boundaries
Resource type: microsoft.keyvault/vaults

What this check verifies

Azure Key Vaults configured with private endpoints have public network access set to Disabled, so connectivity occurs only over the private link.

Risk

Internet exposure alongside a private endpoint breaks isolation and expands attack surface:

Brute-force or token replay on the data plane
Abuse of misconfigured allowlists or trusted bypass
DDoS on the public endpoint This can enable secret exfiltration or unauthorized key use, impacting confidentiality and integrity.

Recommendation

Restrict access to private endpoints only:

Set publicNetworkAccess to Disabled
Avoid broad allowlists; limit Trusted services
Use private DNS with controlled egress
Enforce least privilege and monitor access logs This sustains defense in depth and prevents Internet exposure.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az keyvault update —resource-group <resource_group> —name <vault_name> —public-network-access Disabled

resource "azurerm_key_vault" "kv" {
  name                = "<example_resource_name>"
  location            = "<location>"
  resource_group_name = "<example_resource_name>"
  tenant_id           = "<tenant_id>"
  sku_name            = "standard"

  public_network_access_enabled = false # Critical: disables public access when using private endpoints
}

// Disable public network access for the Key Vault
resource kv 'Microsoft.KeyVault/vaults@2023-07-01' = {
  name: '<example_resource_name>'
  location: '<location>'
  properties: {
    tenantId: '<tenant_id>'
    sku: {
      name: 'standard'
      family: 'A'
    }
    publicNetworkAccess: 'Disabled' // Critical: disables public access so only private endpoints are used
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = keyvault_access_only_through_private_endpoints. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

Custom role is not a subscription owner role Key in non-RBAC Key Vault has expiration date set

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires