App Service environments should have internal encryption enabled
Setting `InternalEncryption` to true on an App Service Environment encrypts the pagefile, the worker disks, and the internal network traffic that flows between the front ends and the workers within that environment.
Setting InternalEncryption to true encrypts the pagefile, worker disks, and internal network traffic between the front ends and workers in an App Service Environment.
What this control checks
App Service Environment must have clusterSettings InternalEncryption set to true.
Common pitfalls
Effect can be set to Disabled
The effect parameter allows "Audit" or "Disabled". The default value is "Audit".
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "App Service Environment should have internal encryption enabled." (bfe08d89-8736-48a7-b88e-76fa3f286881) and "App Service Environment should have internal encryption enabled" (fb74e86f-d351-4b8d-b034-93da7391c01f); PowerPipe control azure_compliance.control.app_service_environment_internal_encryption_enabled.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-28 (Protection of Information at Rest) and SC-28(1) (Cryptographic Protection).
NIST Cybersecurity Framework v2.0: Mapped to PR.DS-01 (The confidentiality, integrity, and availability of data-at-rest are protected.).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- 3.1.h Public Key Infrastructure (PKI)
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
Related controls
- Azure Spring Cloud should use network injection
- App Service apps should have App Service authentication configured
- Automation account variables should have encryption enabled
- Azure HDInsight clusters should use encryption at host to encrypt data at rest
- Storage accounts should use Microsoft-managed key for encryption
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
app_service_environment_internal_encryption_enabled - Powerpipe Control:
azure_compliance.control.app_service_environment_internal_encryption_enabled - Azure Policy Definitions:
bfe08d89-8736-48a7-b88e-76fa3f286881,fb74e86f-d351-4b8d-b034-93da7391c01f
Last reviewed: 2026-10-10