# Cis Azure Compute 15.4

> Ensure Private endpoints are considered for Batch accounts

- Skill: `cyberstrikeus/cis-azure-compute-15-4` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-azure-compute-15-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-azure-compute-15-4/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-azure-compute-15-4

---


# Ensure Private endpoints are considered for Batch accounts

## Description

Private endpoints for Azure Batch accounts ensure all network communication occurs over private networks rather than the public internet.

## Rationale

Configuring private endpoints for Azure Batch accounts ensures all network traffic remains within the Microsoft Azure backbone network, eliminating exposure to public internet threats. This meets zero-trust security principles by enforcing network-level isolation and reducing the attack surface. The configuration also enables precise network monitoring through Azure Network Watcher and NSG flow logs.

## Impact

Private endpoints come with an increased cost and complexity.

## Audit Procedure

### Using Azure Portal

1. Login to Azure Portal `https://portal.azure.com/`
2. Navigate to `Batch Accounts`

For each Batch Account, perform the following:

1. Under Settings, click on `Networking`
2. Click the `Private access` tab
3. For each Private Endpoint listed, ensure that the connection state is `Approved`

### Using Azure CLI

To list Private Endpoints from CLI:

```bash
az network private-endpoint list \
    --resource-group <RESOURCE_GROUP> \
    --query "[?privateLinkServiceConnections[?contains(properties.privateLinkServiceId, 'Microsoft.Batch/batchAccounts/<BATCH_ACCOUNT_NAME>')]]"
```

Expected: Should return at least one private endpoint configuration.

### Using Azure PowerShell

To list Private Endpoints from PowerShell:

```powershell
Get-AzPrivateEndpoint -ResourceGroupName <RESOURCE_GROUP> |
    Where-Object { $_.PrivateLinkServiceConnections.PrivateLinkServiceId -match "Microsoft.Batch/batchAccounts/<BATCH_ACCOUNT_NAME>" }
```

## Expected Result

At least one private endpoint should be configured and in `Approved` connection state for each Batch account.

## Remediation

### Using Azure Portal

1. Navigate to your Batch account
2. Under the Settings drop down, click `Networking`
3. Click the `Private access` tab
4. Click `+ Private endpoint`
5. Configure:
   - Virtual network and subnet
   - DNS integration (auto-approved recommended)
   - Target subresource: batchAccount

### Using Azure CLI

```bash
az network private-endpoint create \
  --name batch-pe \
  --resource-group <rg> \
  --vnet-name <vnet> \
  --subnet <subnet> \
  --private-connection-resource-id /subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.Batch/batchAccounts/<account> \
  --group-id batchAccount \
  --connection-name batch-connection
```

## Default Value

Private endpoints are not configured by default.

## References

1. https://docs.microsoft.com/en-us/azure/batch/private-connectivity

## Profile

Level 2 | Automated