Azure Compliance ControlsAzure App Service
App Service environments should have internal encryption enabled
Setting `InternalEncryption` to true on an App Service Environment encrypts the pagefile, the worker disks, and the internal network traffic that flows between the front ends and the workers within that environment.
What this control checks
App Service Environment must have clusterSettings InternalEncryption set to true.
Framework mappings
The clauses this control is mapped to in each framework.
- SC-28 Protection of Information at Rest
- SC-28(1): Cryptographic Protection
- 3.13.16: Protect the confidentiality of CUI at rest.
- 3.1.h Public Key Infrastructure (PKI)
- SC-28 Protection Of Information At Rest
- SC-28(1) Cryptographic Protection
Related controls
- Azure Spring Cloud should use network injection
- App Service apps should have App Service authentication configured
- Automation account variables should have encryption enabled
- Azure HDInsight clusters should use encryption at host to encrypt data at rest
- Storage accounts should use Microsoft-managed key for encryption
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
app_service_environment_internal_encryption_enabled - Powerpipe Control:
azure_compliance.control.app_service_environment_internal_encryption_enabled - Azure Policy Definitions:
bfe08d89-8736-48a7-b88e-76fa3f286881,fb74e86f-d351-4b8d-b034-93da7391c01f
Last reviewed: 2026-10-10