Azure Compliance ControlsAzure App Configuration
App Configuration stores should have encryption enabled
Enabling App Configuration encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. Checkov CKV_AZURE_186 ensures the App configuration encryption block is set.
What this control checks
App Configuration store has an encryption key_vault_key_identifier set; otherwise it fails
Framework mappings
The clauses this control is mapped to in each framework.
- 3.1.h Public Key Infrastructure (PKI)
Related controls
- PostgreSQL servers should use customer-managed keys to encrypt data at rest
- PostgreSQL servers should have infrastructure encryption enabled
- Managed disks should use both platform-managed and customer-managed keys for double encryption
- AKS clusters should use customer-managed keys to encrypt both OS and data disks
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
app_configuration_encryption_enabled - Checkov Check:
CKV_AZURE_186 - Powerpipe Control:
azure_compliance.control.app_configuration_encryption_enabled
Last reviewed: 2026-10-09