Azure resources with public network access

A resource with public network access enabled has an endpoint that is reachable from the internet. Access still requires authentication and authorisation, but the service is exposed to credential attacks, leaked keys and misconfigured access rules. Microsoft documents that a storage account can be limited to selected networks or to private endpoints, and that Azure SQL has a public network access setting you can turn off so only private endpoints are accepted (see the Microsoft Learn pages listed in the sources). Knowing which resources are open is the first step to closing the ones that do not need it.

This Azure CLI script is read-only: it only runs list and show commands and changes nothing. Sign in with an account that has the Reader role on the subscriptions you want to check.

az login
for sub in $(az account list --query "[].id" -o tsv); do
  echo "== Subscription $sub"
  echo "-- Storage accounts with public network access"
  az storage account list --subscription "$sub" \
    --query "[?publicNetworkAccess!='Disabled'].{name:name, group:resourceGroup, publicNetworkAccess:publicNetworkAccess, defaultAction:networkRuleSet.defaultAction}" -o table
  echo "-- SQL servers with public network access"
  az sql server list --subscription "$sub" \
    --query "[?publicNetworkAccess=='Enabled'].{name:name, group:resourceGroup, publicNetworkAccess:publicNetworkAccess}" -o table
  echo "-- Key Vaults with public network access"
  for id in $(az keyvault list --subscription "$sub" --query "[].id" -o tsv); do
    az keyvault show --ids "$id" \
      --query "{name:name, publicNetworkAccess:properties.publicNetworkAccess}" -o tsv
  done
done

Every storage account or SQL server listed has public network access that is not disabled; the Key Vault lines list every vault with its setting. For a storage account, check defaultAction: Allow means any network can reach the endpoint, while Deny means only the firewall rules and virtual networks you listed can. A SQL server shown as Enabled accepts public connections subject to its server firewall rules. For Key Vault, the last column shows Enabled or Disabled; an empty value means the property is not reported, so check that vault's networking settings in the portal. The script covers three resource types only, so treat an empty result as "none of these", not as "no exposure anywhere".

For each resource, decide whether it really needs to be reachable from the internet. If not, create a private endpoint and then disable public network access, or restrict access to selected networks. If it does need public reach, keep the firewall rules as narrow as possible and record the reason. Test dependent applications first, because disabling public access blocks clients that connect over the internet.

ConfigCobra's Inventory & Insights lists Azure resources across your subscriptions (compute, storage, networking, databases, Key Vault, identity, monitoring) together with their security properties, including public network access. The per-cloud and "All clouds" views show where exposure sits, findings link back to the exact resource they concern, and you can export the list to CSV. Every connected cloud is scanned automatically every day, and ConfigCobra stays read-only: it never changes your Azure.