diff --git a/.azure-pipelines/ci-build.yml b/.azure-pipelines/ci-build.yml
index 835d60c9fd7..95d09b92252 100644
--- a/.azure-pipelines/ci-build.yml
+++ b/.azure-pipelines/ci-build.yml
@@ -51,6 +51,12 @@ extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
   parameters:
     pool: $(BuildAgent)
+    # Onboard to 1ES network isolation enforcement for CFSClean / SFI compliance. Enforce mode with an
+    # allowlist for the package ecosystems this build uses so it resolves from approved feeds while
+    # non-allowlisted public egress is blocked.
+    settings:
+      networkIsolationMode: Enforce
+      networkIsolationPolicy: Good,GitHub,NuGet,PowershellGallery,CFSClean,CFSClean3
     sdl:
       binskim:
         enabled: false
diff --git a/.azure-pipelines/command-metadata-refresh.yml b/.azure-pipelines/command-metadata-refresh.yml
index 801e7ebd72b..cfa6f32361c 100644
--- a/.azure-pipelines/command-metadata-refresh.yml
+++ b/.azure-pipelines/command-metadata-refresh.yml
@@ -58,8 +58,12 @@ extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
   parameters:
     pool: $(BuildAgent)
+    # Onboard to 1ES network isolation enforcement for CFSClean / SFI compliance. Enforce mode with an
+    # allowlist for the package ecosystems this build uses so it resolves from approved feeds while
+    # non-allowlisted public egress is blocked.
     settings:
-      networkIsolationPolicy: Permissive
+      networkIsolationMode: Enforce
+      networkIsolationPolicy: Good,GitHub,NuGet,PowershellGallery,CFSClean,CFSClean3
     sdl:
       binskim:
         enabled: false
diff --git a/.azure-pipelines/weekly-generation.yml b/.azure-pipelines/weekly-generation.yml
index 6be0893c0c6..e859bc415c8 100644
--- a/.azure-pipelines/weekly-generation.yml
+++ b/.azure-pipelines/weekly-generation.yml
@@ -61,6 +61,12 @@ extends:
   template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
   parameters:
     pool: $(BuildAgent)
+    # Onboard to 1ES network isolation enforcement for CFSClean / SFI compliance. Enforce mode with an
+    # allowlist for the package ecosystems this build uses so it resolves from approved feeds while
+    # non-allowlisted public egress is blocked.
+    settings:
+      networkIsolationMode: Enforce
+      networkIsolationPolicy: Good,GitHub,NuGet,PowershellGallery,CFSClean,CFSClean3
     sdl:
       binskim:
         enabled: false