The default_action for network rules should come into effect when no other rules are matched.
The default action should be set to Deny.
Network rules that allow could cause data to be exposed publicly
Set network rules to deny
The following example will fail the azure-storage-default-action-deny check.
The following example will pass the azure-storage-default-action-deny check.