An Event Hubs namespace with public network access enabled puts your event stream at the internet edge

Why it happens

Public access is the default because it is the path of least friction: the quickstart works, the Kafka client connects, the Function trigger fires, all without touching networking. Nothing in the create flow asks whether the namespace should be private, so a namespace stood up in a hurry tends to stay public.

Event Hubs also gets mentally filed as "plumbing" rather than "data". Teams that would never expose a database review an event stream less carefully, even though the stream often carries the same records in motion. And unlike some services, the namespace firewall lives in a separate networkRuleSets child resource that many templates never define, so there is frequently no IP restriction layered on top of the open endpoint either.

Closing it means setting publicNetworkAccess to Disabled and reaching the namespace over a private endpoint (supported on the Standard tier and above), or at minimum constraining the endpoint with network rules.

What it costs / blast radius

The blast radius is every event hub in the namespace. An attacker who obtains any working credential, a SAS key in a connection string, a leaked Kafka password (which for Event Hubs is usually the connection string itself), can read the live stream, replay retained events, or inject forged ones that downstream consumers process as real. Because the endpoint is public, that credential works from anywhere on earth, not just from inside your network. A public endpoint also invites credential-stuffing and enumeration traffic that a private namespace simply never sees. (Authored assessment of Azure behavior, not a measured statistic.)

See it

resource ehns 'Microsoft.EventHub/namespaces@2024-01-01' = {
  name: 'ehns-telemetry-prod'
  location: location
  sku: { name: 'Standard', tier: 'Standard' }
  properties: {
    publicNetworkAccess: 'Enabled'  // any internet address can connect
  }
}

resource ehns 'Microsoft.EventHub/namespaces@2024-01-01' = {
  name: 'ehns-telemetry-prod'
  location: location
  sku: { name: 'Standard', tier: 'Standard' }  // Private Link needs Standard or above
  properties: {
    publicNetworkAccess: 'Disabled'  // only private endpoints reach it
  }
}

// Then connect producers and consumers through a private endpoint
// (Microsoft.Network/privateEndpoints targeting the namespace) so
// traffic stays on your VNet instead of the public internet.