Service Bus public network access enabled: default exposure

What it is

A Service Bus namespace whose publicNetworkAccess property is set to Enabled, the state Azure creates it in. The namespace endpoint resolves publicly and accepts AMQP and HTTPS connections from any address on the internet. Service Bus is usually the connective tissue between systems, so the queues and topics behind that endpoint hold work in flight: orders awaiting fulfilment, jobs awaiting workers, integration events other systems act on without question.

Impact (security)

Every queue and topic in the namespace reachable from any network on the public internet, gated only by keys and identity

Basis: Azure behavior (authored assessment). Figures are estimates, not measurements.

Why it happens

Public access is the default because everything just works that way: the sender in one subscription, the Function trigger in another, the on-prem integration over the open internet. Nothing in the create flow raises networking, so networking never gets raised.

There is also a genuine tier trap keeping namespaces public. Private endpoints and VNet service endpoints for Service Bus require the Premium tier, so a Basic or Standard namespace cannot simply be moved behind Private Link; someone has to justify the SKU change first. Teams park that decision, and the namespace stays on the public internet by default in the meantime. (Standard namespaces can at least apply IP firewall rules via ARM, CLI, or PowerShell, which narrows the front door even if it cannot close it.)

Messaging infrastructure also escapes the scrutiny databases get. The broker is "plumbing", yet the payloads moving through it are frequently the same business records at their most actionable moment.

What it costs / blast radius

The blast radius is every queue, topic, and subscription in the namespace. With any working credential, a SAS key from a connection string or an over-permissioned identity, an internet-based attacker can drain queues (stealing and disrupting work in one move), inject forged messages that downstream systems process as legitimate commands, or quietly subscribe to topics and watch your business happen in real time. A public endpoint means every one of those credentials works from anywhere, and the endpoint itself is discoverable and subject to probing that a private namespace never receives. (Authored assessment of Azure behavior, not a measured statistic.)

See it

Footgun: the default — the broker answers on the public internet

resource sbns 'Microsoft.ServiceBus/namespaces@2024-01-01' = {
  name: 'sbns-orders-prod'
  location: location
  sku: { name: 'Premium', tier: 'Premium' }
  properties: {
    publicNetworkAccess: 'Enabled'  // any internet address can connect
  }
}

Fix: disable public access and connect over Private Link (Premium tier)

resource sbns 'Microsoft.ServiceBus/namespaces@2024-01-01' = {
  name: 'sbns-orders-prod'
  location: location
  sku: { name: 'Premium', tier: 'Premium' }  // private endpoints need Premium
  properties: {
    publicNetworkAccess: 'Disabled'  // only private endpoints reach it
  }
}

// Then add a Microsoft.Network/privateEndpoints resource targeting the
// namespace so senders and receivers connect over your VNet.
// On Basic/Standard, apply IP firewall rules via ARM/CLI as the
// interim control until the Premium move is justified.

How StratoLens helps

StratoLens flags every Service Bus namespace that still allows public network access, automatically and continuously, across all your subscriptions and inside your own tenant. The namespaces carrying your most operational data stop being the ones nobody remembered to check.