App Service web app has HTTP/2.0 enabled

Check ID: app_ensure_using_http20
Provider: Azure
Service: app
Severity: LOW
Categories: resilience
Resource type: microsoft.web/sites

What this check verifies

Azure App Service web apps are evaluated for HTTP/2 support via the http20_enabled configuration, indicating whether the site serves traffic using the HTTP/2 protocol

Risk

Without HTTP/2, apps remain on HTTP/1.1, increasing connection overhead and head-of-line blocking, which can reduce availability under load. Inefficient use of TLS sessions raises DoS susceptibility and degrades user experience, impacting service reliability

Recommendation

Enable HTTP/2 (http20_enabled=true) to use a modern, efficient transport.

Enforce HTTPS Only and a strong minimum TLS version for defense-in-depth
Validate app/library compatibility before rollout
Monitor performance and errors post-change; deploy gradually

Remediation

CLI
Terraform
Native IaC
Dashboard steps

az webapp config set —resource-group <RESOURCE_GROUP_NAME> —name <APP_NAME> —http20-enabled true

# Enable HTTP/2.0 for an App Service (use azurerm_linux_web_app or azurerm_windows_web_app)
resource "azurerm_linux_web_app" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<LOCATION>"
  resource_group_name = "<example_resource_group>"
  service_plan_id     = "<example_resource_id>"

  site_config {
    http2_enabled = true # Critical: enables HTTP/2.0
  }
}

// Enable HTTP/2.0 on an existing App Service web app
resource webConfig 'Microsoft.Web/sites/config@2022-09-01' = {
  name: '<example_resource_name>/web'
  properties: {
    http20Enabled: true // Critical: enables HTTP/2.0 for the app
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = app_ensure_using_http20. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Azure checks

App Service web app uses the latest Python version App Service web app has FTP disabled or FTPS-only enforced

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires