Application gateways should have the SSL policy's 'Min protocol version' set to 'TLSv1_2' or higher
The TLS protocol secures transmission of data between servers and clients by encrypting the data stream. Vulnerabilities in older versions of TLS can lead to potential security risks. Setting the minimum TLS version to TLSv1_2 or higher ensures that only secure versions of the protocol are used.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Application Gateway should be running TLS version 1.2 or newer" (6313cbe8-6fb7-451b-a9e3-3f23b59843ca); PowerPipe control azure_compliance.control.application_gateway_min_tls_1_2.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_218.
Framework-specific interpretation
CIS Azure Benchmark v5.0.0: Mapped to 7.12 (Ensure the SSL policy's 'Min protocol version' is set to 'TLSv1_2' or higher on Azure Application Gateway).
Framework mappings
The clauses this control is mapped to in each framework.
- 7.12 Ensure the SSL policy's 'Min protocol version' is set to 'TLSv1_2' or higher on Azure Application Gateway
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
application_gateway_min_tls_1_2 - Checkov Check:
CKV_AZURE_218 - Powerpipe Control:
azure_compliance.control.application_gateway_min_tls_1_2 - Azure Policy Definition:
6313cbe8-6fb7-451b-a9e3-3f23b59843ca
Last reviewed: 2026-10-10