---
title: Default network access rule for storage accounts should be set to deny
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Default network access rule for storage
  accounts should be set to deny
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Default network access rule for storage accounts should be set to deny
 
## Description{% #description %}

Azure Storage accounts should set the default network access rule to deny, so that only allowed virtual networks and IP addresses can reach the account. This rule skips storage accounts with public network access set to Disabled.

## Remediation{% #remediation %}

Set public network access to **Enabled from selected virtual networks and IP addresses**, then add rules for the networks that need access. See [Set the default public network access rule](https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security-set-default-access).

## References{% #references %}

- [Set the default public network access rule](https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security-set-default-access)
- [Azure Storage firewall rules and network access](https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security)
- [az storage account](https://learn.microsoft.com/en-us/cli/azure/storage/account)
- [CIS Microsoft Azure Foundations Benchmark](https://www.cisecurity.org/benchmark/azure)