🛡️ Azure Log Analytics Workspace public network access is not disabled🟢

• Contextual name: 🛡️ Log Analytics Workspace public network access is not disabled🟢
• ID: /ce/ca/azure/log-analytics/workspace-public-network-access
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Log Analytics Workspace
  • 🔌 Azure Log Analytics Workspace - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

A Log Analytics workspace accepts ingestion and queries from any network, or only from networks connected through an Azure Monitor Private Link Scope (AMPLS). The Allow public network access for ingestion and Allow public network access for queries settings select between them; each is Enabled (Yes), Disabled (No), or SecuredByPerimeter. Prerequisites: Link the workspace to an Azure Monitor Private Link Scope reached through a private endpoint with private DNS from every network whose agents, clients, or users send data to or query it.

Rationale

With public access enabled, the workspace answers queries and accepts ingestion from any internet-connected client that holds a valid credential. A stolen credential therefore exposes the security evidence collected in the workspace to bulk reading from anywhere, and lets an attacker write fabricated records into it, with no network boundary behind authentication to contain either.

Audit

This policy marks an Azure Log Analytics Workspace as INCOMPLIANT if either public network access setting is Enabled or SecuredByPerimeter.

... see more

Remediation

Open File

Remediation

Link the workspace to an Azure Monitor Private Link Scope with a private endpoint and working private DNS for every required client before disabling public access. Clients outside those networks can lose ingestion or query access, including integrations that cannot use Private Link.

In Log Analytics workspaces > Network Isolation, set public network access for both ingestion and queries to No. Alternatively:

az monitor log-analytics workspace update --resource-group {{resource-group}} --workspace-name {{workspace-name}} --public-network-access-for-ingestion Disabled --public-network-access-for-query Disabled

Verify both settings are Disabled and test ingestion and queries from each required network. If a required client loses access, restore its prior access setting while correcting Private Link connectivity.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 6.1.6 Ensure that 'Public Network Access' for Ingestion and Queries is 'Disabled' for Log Analytics Workspaces (Automated)			1		no data
💼 Cloudaware Framework → 💼 Network Exposure			144		no data