diff --git a/08-Secure by default/Secure Templates/Bicep/KeyVault.bicep b/08-Secure by default/Secure Templates/Bicep/KeyVault.bicep
index ff4c2882..ab7e34cb 100644
--- a/08-Secure by default/Secure Templates/Bicep/KeyVault.bicep	
+++ b/08-Secure by default/Secure Templates/Bicep/KeyVault.bicep	
@@ -43,6 +43,7 @@ resource keyVaultName_resource 'Microsoft.KeyVault/vaults@2015-06-01' = {
     enabledForVolumeEncryption: enableVaultForVolumeEncryption
     tenantId: tenantId
     accessPolicies: accessPolicies
+    publicNetworkAccess: 'Disabled'
     sku: {
       name: vaultSku
       family: 'A'
@@ -81,4 +82,4 @@ resource keyVaultName_Microsoft_Insights_service 'Microsoft.KeyVault/vaults/prov
   dependsOn: [
     keyVaultName_resource
   ]
-}
\ No newline at end of file
+}