Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
app_minimum_tls_version_12Provider: Azure
Service:
appSeverity: MEDIUM
Categories:
encryptionResource type:
microsoft.web/sites/configWhat this check verifies
Azure App Service web apps are assessed for the configured minimum TLS version for HTTPS. The expected baseline is1.2 or 1.3; settings that permit lower versions indicate acceptance of legacy TLS during client negotiation.
Risk
AllowingTLS 1.0/1.1 enables protocol downgrades and weak cipher negotiation, exposing HTTPS traffic to MITM interception, credential theft, and tampering. This undermines the confidentiality and integrity of sessions and data in transit, and can enable account takeover via stolen tokens.
Recommendation
Enforce a minimum ofTLS 1.2 (prefer 1.3) and disable 1.0/1.1. Require HTTPS-only, enable HSTS, and align with modern cipher suites. Test client compatibility and phase out legacy agents. Document narrow exceptions with compensating controls to uphold defense in depth and prevent downgrades.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az webapp config set —resource-group <RESOURCE_GROUP_NAME> —name <APP_NAME> —min-tls-version 1.2
References
- https://learn.microsoft.com/en-us/+azure/app-service/overview-tls
- https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-bindings#enforce-tls-versions
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/AppService/latest-version-of-tls-encryption-in-use.html
- https://icompaas.freshdesk.com/support/solutions/articles/62000234773-ensure-that-minimum-tls-version-is-set-to-tls-v1-2-or-higher
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = app_minimum_tls_version_12. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks