Check ID:
Provider: Azure
Service:
Severity: MEDIUM
Categories:
Resource type:
storage_ensure_minimum_tls_version_12Provider: Azure
Service:
storageSeverity: MEDIUM
Categories:
encryptionResource type:
microsoft.storage/storageaccountsWhat this check verifies
Azure Storage accounts enforce aminimum TLS version of 1.2 for client connections to data services
Risk
Allowing TLS1.0/1.1 enables protocol downgrades and exploitation of known flaws (e.g., BEAST), weakening confidentiality and integrity. Attackers can intercept or modify data in transit and harvest credentials via weakened cipher suites.
Recommendation
Set the storage accountminimum TLS version to at least 1.2 (prefer 1.3 where supported) and disable legacy protocols. Apply defense in depth by restricting network access, using least privilege credentials, and monitoring handshake failures to identify outdated clients.
Remediation
- CLI
- Terraform
- Native IaC
- Dashboard steps
az storage account update —resource-group <RESOURCE_GROUP> —name <STORAGE_ACCOUNT_NAME> —min-tls-version TLS1_2
References
- https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/StorageAccounts/minimum-tls-version.html
- https://learn.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version?tabs=portal
Where this check fires
This check runs on every scheduled scan against your Azure account. Findings appear at Cloud Security → Findings filterable byCheck ID = storage_ensure_minimum_tls_version_12. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Azure checks