Check Details

• Resource: Azure Cosmos DB (DocumentDB)
• Check: Ensure Private Endpoints Are Enabled
• Risk: If private connectivity is not enabled, Cosmos DB accounts may be accessible via public endpoints, increasing the risk of unauthorised access, data leakage, and exposure to internet-based attacks.

Remediation via Azure Portal

1. Log in to the Azure Portal.
2. Navigate to Azure Cosmos DB and select the affected database account.
3. In the left-hand menu, select Networking.
4. Under Public network access, ensure it is set to Disabled or restricted.
5. Under Private access connections, click + Private endpoint.
6. Select the appropriate Virtual Network and Subnet, then complete the configuration wizard.
7. Click Review + create, then Create to deploy the private endpoint.

Remediation via Azure CLI

1. Open Azure Cloud Shell or a local terminal with Azure CLI installed.
2. Disable public network access:
   

   az cosmosdb update \
    --resource-group <resource-group> \
    --name <cosmos-account-name> \
    --public-network-access Disabled
   

3. Create a private endpoint for the Cosmos DB account:
   

   az network private-endpoint create \
    --resource-group <resource-group> \
    --name <private-endpoint-name> \
    --vnet-name <vnet-name> \
    --subnet <subnet-name> \
    --private-connection-resource-id $(az cosmosdb show \
      --resource-group <resource-group> \
      --name <cosmos-account-name> \
      --query id --output tsv) \
    --group-id Sql \
    --connection-name <connection-name>
   

4. Verify that public access is disabled:
   

   az cosmosdb show \
    --resource-group <resource-group> \
    --name <cosmos-account-name> \
    --query publicNetworkAccess
   

The output should return "Disabled", confirming that public access is turned off and private connectivity is enforced.