Restrict Network Access to Sensitive Services

Info

ID: MS-M7013
MITRE mitigation: M1035

Limit access to sensitive interfaces such as admin consoles, databases, storage buckets, and service-to-service APIs by using IP allowlists, private networking, or VPN requirements. This reduces the attack surface by preventing access from unauthorized networks.

Techniques Addressed by Mitigation

ID	Name	Use
MS-TA7005	Exposed/misconfigured admin interfaces	Limit access to administrative endpoints using IP allowlists, private networking, or VPN requirements.
MS-TA7020	Access to connected cloud storage	Use private endpoints, VPC/VNET integration, or firewall rules to limit storage access to authorized networks.
MS-TA7025	Access application database	Use private endpoints, VPC/VNET integration, or firewall rules to prevent direct internet access to databases.