Azure Compliance ControlsAzure App Service
App Service apps should have Client Certificates (Incoming client certificates) enabled
Checks that the Azure App Service web app has incoming client certificates enabled, so only clients presenting a valid certificate can reach the app. Trivy `AZU-0001` verifies that the Web App accepts incoming client certificates.
What this control checks
Web app has Client Certificates (Incoming client certificates) set; apps without it fail.
Framework mappings
The clauses this control is mapped to in each framework.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 2.2.7: System components are configured and managed securely.
1 more clause
- 8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- Configuration Settings (CM-6)
- 9.4 Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On'
- CM-6 Configuration Settings
- 0915.09s2Organizational.2-09.s 09.08 Exchange of Information
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_api_app_client_certificates_on - Checkov Check:
CKV_AZURE_17 - Powerpipe Controls:
azure_compliance.control.appservice_api_app_client_certificates_on,azure_compliance.control.appservice_web_app_incoming_client_cert_on - Prowler Check:
app_client_certificates_on - Trivy Check:
AZU-0001
Last reviewed: 2026-10-10