🛡️ Azure Network Subnet default outbound access is not disabled🟢⚪

• Contextual name: 🛡️ Network Subnet default outbound access is not disabled🟢⚪
• ID: /ce/ca/azure/virtual-network/subnet-default-outbound-access
• Tags:
  • ⚪ Impossible policy
  • 🟢 Policy with categories
  • 🟢 Policy with type
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Description

Open File

Description

Virtual machines without an explicit outbound method reach public endpoints through default outbound access, a Microsoft-owned public IP address, unless their subnet is private. The subnet's Default outbound access setting is Enabled or Disabled (private); delegated subnets and the subnets reserved for gateways, Azure Firewall, Route Server, and Bastion are out of scope. Prerequisites: Give each virtual machine that needs public endpoints an explicit outbound method, such as a NAT gateway, before disabling default outbound access.

Rationale

Default outbound access gives a virtual machine an internet egress path nobody configured, through a Microsoft-owned public IP address that can change without notice. A compromised workload can use that path for data exfiltration or command- and-control traffic that leaves from an address the organization does not own and passes through no egress firewall or NAT gateway it controls.

Audit

This requirement needs manual assessment. Subnet defaultOutboundAccess and delegation evidence required for scope exclusions are not collected.

Remediation

Open File

Remediation

Virtual machines without an explicit outbound method reach public endpoints through default outbound access, a Microsoft-owned public IP address, unless their subnet is private. The subnet's Default outbound access setting is Enabled or Disabled (private); delegated subnets and the subnets reserved for gateways, Azure Firewall, Route Server, and Bastion are out of scope. Prerequisites: Give each virtual machine that needs public endpoints an explicit outbound method, such as a NAT gateway, before disabling default outbound access.

In Virtual networks, select the affected virtual network and open Settings > Subnets. Select each in-scope subnet, set Default outbound access to Disabled, and save. Verify that required outbound connections use the approved explicit outbound method.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 7.11 Ensure 'Default outbound access' is Set to 'Disabled' for Virtual Network Subnets (Automated)			1		no data
💼 Cloudaware Framework → 💼 Network Exposure			144		no data