Check ID: app_minimum_tls_version_12
Provider: Azure
Service: app
Severity: MEDIUM
Categories: encryption
Resource type: microsoft.web/sites/config

What this check verifies

Azure App Service web apps are assessed for the configured minimum TLS version for HTTPS. The expected baseline is 1.2 or 1.3; settings that permit lower versions indicate acceptance of legacy TLS during client negotiation.

Risk

Allowing TLS 1.0/1.1 enables protocol downgrades and weak cipher negotiation, exposing HTTPS traffic to MITM interception, credential theft, and tampering. This undermines the confidentiality and integrity of sessions and data in transit, and can enable account takeover via stolen tokens.

Recommendation

Enforce a minimum of TLS 1.2 (prefer 1.3) and disable 1.0/1.1. Require HTTPS-only, enable HSTS, and align with modern cipher suites. Test client compatibility and phase out legacy agents. Document narrow exceptions with compensating controls to uphold defense in depth and prevent downgrades.

Remediation

az webapp config set —resource-group <RESOURCE_GROUP_NAME> —name <APP_NAME> —min-tls-version 1.2

References

Where this check fires

This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable by Check ID = app_minimum_tls_version_12. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks