Web app requires incoming client certificates

Check ID: app_client_certificates_on
Provider: Azure
Service: app
Severity: MEDIUM
Categories: identity-access
Resource type: microsoft.web/sites/config

What this check verifies

Azure App Service apps enforce mutual TLS when client certificate mode is set to Required, meaning every inbound request must present a valid client certificate that the app can validate.

Risk

Without mTLS, clients aren’t cryptographically authenticated at the transport layer. Adversaries can reach endpoints using spoofed sources or stolen tokens, leading to unauthorized data access (confidentiality), request tampering (integrity), and automated abuse that degrades service (availability).

Recommendation

Set client certificate mode to Required and validate client certs in application logic (issuer, validity, revocation). Enforce HTTPS only, avoid broad exclusion paths, and manage certs via a trusted CA with rotation and revocation. Apply least privilege and zero trust, layering with private access or IP restrictions as needed.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az webapp update --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --set clientCertEnabled=true clientCertMode=Required

# Require client certificates for the App Service (use azurerm_linux_web_app or azurerm_windows_web_app)
resource "azurerm_linux_web_app" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<example_location>"
  resource_group_name = "<example_resource_name>"
  service_plan_id     = "<example_resource_id>"

  client_certificate_enabled = true      # Critical: enables mutual TLS
  client_certificate_mode    = "Required" # Critical: enforces client certs (passes the check)

  site_config {}
}

// Require client certificates for the web app
resource appService 'Microsoft.Web/sites@2022-03-01' = {
  name: '<example_resource_name>'
  location: '<example_location>'
  properties: {
    serverFarmId: '<example_resource_id>'
    clientCertEnabled: true   // Critical: enables mutual TLS
    clientCertMode: 'Required' // Critical: enforces client certs (passes the check)
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = app_client_certificates_on. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

No LLM Jacking detected in API Management instances App Service app has App Service Authentication enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires