# Cis Azure Compute 15.5

> Cis Azure Compute 15.5 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure public network access is disabled for Batch accounts

- Skill name: `cis-azure-compute-15.5`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Cloud_Providers/Microsoft_Azure/CIS_Microsoft_Azure_Compute_Services_Benchmark_v2.0.0/cis-azure-compute-15.5/SKILL.md
- Repository: CyberStrikeus/CyberStrike (1,211 GitHub stars when collected)

## SKILL.md

# Ensure public network access is disabled for Batch accounts

## Description

Disabling public network access ensures all connectivity occurs through private endpoints or approved virtual networks.

## Rationale

Public network access exposes Batch accounts to internet threats like DDoS attacks and unauthorized access, violating Zero Trust principles and compliance requirements for secure data processing environments.

## Impact

A virtual network or private endpoint should be implemented for the Batch account prior to disabling public network access.

## Audit Procedure

### Using Azure Portal

1. Login to `https://portal.azure.com`
2. For each Batch Account, click on the Batch account name
3. Navigate to the `Settings` drop-down, then click `Networking`.
4. Under the `Public access` tab, ensure that Public Network Access is set to `Disabled`.

Repeat for each Batch account in scope.

### Using Azure CLI

```bash
az batch account show \
  --name <batch-account-name> \
  --resource-group <resource-group> \
  --query "publicNetworkAccess"
```

### Using Azure PowerShell

```powershell
(Get-AzBatchAccount -Name "<batch-account-name>").PublicNetworkAccess
```

Expected Output: **Disabled**

## Expected Result

The `publicNetworkAccess` setting should be `Disabled` for all Batch accounts.

## Remediation

### Using Azure Portal

1. Login to `https://portal.azure.com`
2. For each Batch Account, click on the Batch account name
3. Navigate to the `Settings` drop-down, then click `Networking`.
4. Under the `Public access` tab, ensure that Public Network Access is set to `Disabled`.
5. Click `Save`

Repeat for each Batch account in scope.

### Using Azure CLI

```bash
az batch account update \
  --name <account-name> \
  --resource-group <rg-name> \
  --public-network-access Disabled
```

### Using Azure PowerShell

```powershell
Update-AzBatchAccount -Name <account-name> -ResourceGroupName <rg-name> -PublicNetworkAccess Disabled
```

## Default Value

Public network access is **enabled** by default for new Batch accounts.

## References

1. https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/batch-security-baseline#ns-4
2. https://learn.microsoft.com/en-us/azure/batch/private-connectivity

## Profile

Level 1 | Automated

---

Source: https://www.openparable.com/skill/devops-security/cis-azure-compute-15-5 (OpenParable). Cite the canonical URL above.