Description
An enabled public endpoint allows Azure AI Search, formerly Cognitive Search, to receive public-network requests. Public access does not imply anonymous data access; authentication and firewall settings still apply.
Potential impact
Unnecessary public access can provide a data-exposure path when authentication is misconfigured or credentials are leaked.
Remediation
For private access, configure a Private Endpoint and DNS before setting public_network_access_enabled = false. Verify connectivity from existing clients.
Examples
The examples change only the public-access option. Configure Private Endpoint connectivity and authentication separately.
Before
hcl
resource "azurerm_search_service" "example" {
name = "example-search-service"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
sku = "standard"
public_network_access_enabled = true
}
After
hcl
resource "azurerm_search_service" "example" {
name = "example-search-service"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
sku = "standard"
public_network_access_enabled = false
}