# Cis Azure Compute 15.5

> Ensure public network access is disabled for Batch accounts

- Skill: `cyberstrikeus/cis-azure-compute-15-5` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-azure-compute-15-5`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-azure-compute-15-5/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-azure-compute-15-5

---


# Ensure public network access is disabled for Batch accounts

## Description

Disabling public network access ensures all connectivity occurs through private endpoints or approved virtual networks.

## Rationale

Public network access exposes Batch accounts to internet threats like DDoS attacks and unauthorized access, violating Zero Trust principles and compliance requirements for secure data processing environments.

## Impact

A virtual network or private endpoint should be implemented for the Batch account prior to disabling public network access.

## Audit Procedure

### Using Azure Portal

1. Login to `https://portal.azure.com`
2. For each Batch Account, click on the Batch account name
3. Navigate to the `Settings` drop-down, then click `Networking`.
4. Under the `Public access` tab, ensure that Public Network Access is set to `Disabled`.

Repeat for each Batch account in scope.

### Using Azure CLI

```bash
az batch account show \
  --name <batch-account-name> \
  --resource-group <resource-group> \
  --query "publicNetworkAccess"
```

### Using Azure PowerShell

```powershell
(Get-AzBatchAccount -Name "<batch-account-name>").PublicNetworkAccess
```

Expected Output: **Disabled**

## Expected Result

The `publicNetworkAccess` setting should be `Disabled` for all Batch accounts.

## Remediation

### Using Azure Portal

1. Login to `https://portal.azure.com`
2. For each Batch Account, click on the Batch account name
3. Navigate to the `Settings` drop-down, then click `Networking`.
4. Under the `Public access` tab, ensure that Public Network Access is set to `Disabled`.
5. Click `Save`

Repeat for each Batch account in scope.

### Using Azure CLI

```bash
az batch account update \
  --name <account-name> \
  --resource-group <rg-name> \
  --public-network-access Disabled
```

### Using Azure PowerShell

```powershell
Update-AzBatchAccount -Name <account-name> -ResourceGroupName <rg-name> -PublicNetworkAccess Disabled
```

## Default Value

Public network access is **enabled** by default for new Batch accounts.

## References

1. https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/batch-security-baseline#ns-4
2. https://learn.microsoft.com/en-us/azure/batch/private-connectivity

## Profile

Level 1 | Automated