How do I stop resources from getting public IP addresses in Azure?

Use Azure Policy to deny public IPs. There are built-in policies such as 'Network interfaces should not have public IPs' that, set to the Deny effect, block a network interface from being created or updated with an associated public IP. Assign it at a management group or subscription scope so it covers all workloads, and pair it with policies that disable public network access on your PaaS services.

How do I enforce private endpoints with Azure Policy?

Enforcing private endpoints is a combination: deny or audit public network access on PaaS resources (for example 'Storage accounts should disable public network access' and the equivalents for SQL, Key Vault and others) so the only way in is private, and use the private-endpoint audit policies to flag resources that lack one. Together they steer teams to deploy a private endpoint plus private DNS instead of exposing a public endpoint.

Why is denying public IPs an important guardrail?

Public exposure is the most common serious misconfiguration and the one attackers scan for constantly. A VM with a public IP and an open management port, or a storage account left publicly reachable, is exactly how many breaches start. Denying public IPs and disabling public network access removes that entire class of accidental exposure by default, so a resource has to be deliberately and explicitly opened rather than accidentally left open.

Won't denying public IPs break legitimate internet-facing services?

Some services genuinely need public ingress, so you don't deny it everywhere blindly. The pattern is to deny public IPs broadly and route legitimate internet traffic through controlled front doors — a load balancer, Application Gateway, Azure Front Door, or Azure Firewall — rather than a public IP on each VM. Run the policy in audit mode first to find the resources that would be affected, exempt the intentional edge services, then enforce.

Field notes · Governance

Deny public IPs

Denying public IPs and enforcing private endpoints with Azure Policy

By Captain O7 min read

Every breach post-mortem has the same first line somewhere in it: "it was reachable from the internet, and it shouldn't have been." Azure Policy lets you make that sentence impossible to write by accident.

New to cloud? CAMPUX is a free, build-first course. Start here →

Reduce public exposure with a pair of Azure Policy moves: deny public IPs on network interfaces so VMs can't be handed a direct internet address, and disable public network access on PaaS services (storage, SQL, Key Vault) so their only path in is a private endpoint. Deny broadly, route legitimate ingress through a controlled front door, and roll it out in audit first so you can exempt the services that genuinely need the edge. Public-by-accident becomes impossible; public-on-purpose stays deliberate.

Public exposure is the misconfiguration attackers scan for around the clock. A VM with a public IP and an open management port, or a storage account left publicly reachable, is how a huge share of incidents begin — not through some clever exploit, but through a door someone left open without meaning to. Policy closes that door by default.

Deny public IPs on VMs

A VM gets its internet address from a public IP attached to its network interface. Deny that, and a VM can't be accidentally exposed:

# built-in: "Network interfaces should not have public IPs" (set to Deny)
az policy assignment create \
  --name "deny-nic-public-ip" \
  --policy "83a86a26-fd1f-447c-b59d-e51f44264114" \
  --scope "/subscriptions/<sub>"

Legitimate internet-facing workloads still get in — just not through a public IP on every VM. Route ingress through a controlled front door: a load balancer, Application Gateway, Front Door, or Azure Firewall. That's better architecture anyway; the policy nudges you toward it.

Disable public network access on PaaS

The other half is PaaS. Storage accounts, SQL, Key Vault and friends ship reachable over public endpoints by default. Policy flips that:

Storage accounts should disable public network access
Azure SQL should have public network access disabled
Key Vault should disable public network access (and use private endpoints)

With public access off, the only way to reach the service is a private endpoint — a private IP inside your VNet — plus the private DNS to resolve it. If that trade-off is fuzzy, our service endpoints vs private endpoints note lays it out; the policy is what makes private the default instead of the exception.

Audit — and exempt the intentional edge

Some services are supposed to face the internet. So you don't blind-deny everywhere; you deny broadly and exempt deliberately.

Audit, then exempt, then deny

Assign these in Audit first and read the compliance results — they'll surface every public IP and publicly-reachable service you have, which is a useful inventory on its own. Exempt the genuine edge services (your Front Door, a public web tier) with a policy exemption, then switch to Deny. Enforcing before you've seen the list is how you break the one service that's meant to be public.

Attackers don't pick the lock when the window's open. Deny public by default and there's no open window to find.

Questions people also ask

How do I stop resources from getting public IPs?

Assign a built-in like "Network interfaces should not have public IPs" set to Deny, at a management group or subscription scope, so a NIC can't be created with a public IP. Pair it with policies disabling public network access on PaaS.

How do I enforce private endpoints?

Combine disabling public network access on PaaS (storage, SQL, Key Vault) with the private-endpoint audit policies, so the only path in is private and resources lacking a private endpoint are flagged. Teams then deploy a private endpoint plus private DNS.

Why is denying public IPs important?

Public exposure is the most common serious misconfiguration and what attackers scan for. Denying public IPs and public network access removes that class of accidental exposure by default, so a resource must be deliberately opened rather than accidentally left open.

Won't it break internet-facing services?

Some services need public ingress, so deny broadly and route legitimate traffic through a load balancer, Application Gateway, Front Door, or Firewall instead of per-VM public IPs. Audit first, exempt the intentional edge, then enforce.