This page has moved to sbdcyber.com

3. Best practice is to disable public access and enable private endpoints. This is difficult to enforce after the fact, but should be enforced by default on all new storage accounts (via policy).

Reason for Mitigating Action:
This action is required to reduce the risk of unauthorised access to Azure Storage Accounts by removing unnecessary public network exposure and requiring access through private endpoints. Enforcing this configuration by policy for all new storage accounts ensures that secure access controls are applied consistently by default and prevents new storage accounts being deployed with unnecessary public accessibility.

CAF v4.0 Mapping:

• Objective: Objective B – Protecting against cyber attack
• Principle: B4 – System Security

Why B4: This action moves beyond controlling individual identities or permissions. Its primary purpose is to establish a secure-by-default technical configuration for Azure Storage Accounts—removing public exposure, using private endpoints, and enforcing that configuration through Azure Policy. Therefore B4 System Security is more directly aligned with this particular mitigation than B2 Identity and Access Control.