App Service API apps should require HTTPS for all access
Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. The Azure Policy flags App Service apps where `httpsOnly` is false or does not exist.
Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. Leaving HTTP accessible enables man-in-the-middle interception, credential and cookie theft, and response tampering.
What this control checks
API apps in Azure App Service must require HTTPS for all access
Common pitfalls
Missing httpsOnly also fails the policy
The policy applies its effect when Microsoft.Web/sites/httpsOnly does not exist or equals false.
Omitting https_only fails the check
Web App Accepting Traffic Other Than HTTPS flags azurerm_app_service, azurerm_linux_web_app and azurerm_windows_web_app with https_only = false or no https_only.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "App Service apps should only be accessible over HTTPS" (a4af4a39-4135-47fb-b175-47fbdf85311d); Prowler check app_ensure_http_is_redirected_to_https (prowler azure --checks app_ensure_http_is_redirected_to_https); PowerPipe control azure_compliance.control.appservice_api_app_use_https.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_14; KICS query "Web App Accepting Traffic Other Than HTTPS" (11e9a948-c6c3-4a0f-8dcf-b5cf1763cdbe); Trivy check AZU-0072.
Framework-specific interpretation
PCI DSS v4.0: Mapped to 1.2.5 (Network security controls (NSCs) are configured and maintained.), 2.2.5 (System components are configured and managed securely.), 2.2.7 (System components are configured and managed securely.) and 2 more clauses.
NIS2 Directive (EU 2022/2555): Mapped to 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;), 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;), 6.2.1 (Before developing a network and information system, including software, the relevant entities shall lay down rules for...) and 4 more clauses.
NIST Cybersecurity Framework v2.0: Mapped to GV.OC-03 (Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties...) and PR.DS-02 (The confidentiality, integrity, and availability of data-in-transit are protected.).
FedRAMP Moderate Baseline Rev 4: Mapped to SC-8 (Transmission Confidentiality And Integrity) and SC-8(1) (Cryptographic Or Alternate Physical Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- 1.2.5: Network security controls (NSCs) are configured and maintained.
- 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
- 2.2.7: System components are configured and managed securely.
- 4.2.1: PAN is protected with strong cryptography during transmission.
- 4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
NIST Cybersecurity Framework v2.0
- GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
- PR.DS-02
FedRAMP Moderate Baseline Rev 4
- SC-8 (1): Cryptographic Or Alternate Physical Protection
- SC-8(1) Cryptographic Or Alternate Physical Protection
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- 3.1.h Public Key Infrastructure (PKI)
- 9.2 Ensure Web App Redirects All HTTP traffic to HTTPS in Azure App Service
- 9.2 Ensure Web App Redirects All HTTP traffic to HTTPS in Azure App Service
- 9.1 Ensure 'HTTPS Only' is set to `On`
- SC.L2-3.13.8 Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards
- SC-8 Transmission Confidentiality And Integrity
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 0809.01n2Organizational.1234-01.n 01.04 Network Access Control
- 0810.01n2Organizational.5-01.n 01.04 Network Access Control
- 0811.01n2Organizational.6-01.n 01.04 Network Access Control
- 0812.01n2Organizational.8-01.n 01.04 Network Access Control
- 0814.01n1Organizational.12-01.n 01.04 Network Access Control
1 more clause
- 0949.09y2Organizational.5-09.y 09.09 Electronic Commerce Services
- 164.312(e)(1) Transmission security
- 164.312(e)(2)(ii) Encryption
- 6.5.3: Insecure cryptographic storage.
- Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using approaches like one-way hashes based on strong cryptography, truncation etc
- Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_api_app_use_https - Checkov Check:
CKV_AZURE_14 - Powerpipe Control:
azure_compliance.control.appservice_api_app_use_https - Prowler Check:
app_ensure_http_is_redirected_to_https - Azure Policy Definition:
a4af4a39-4135-47fb-b175-47fbdf85311d - KICS Query:
11e9a948-c6c3-4a0f-8dcf-b5cf1763cdbe - Trivy Check:
AZU-0072
Last reviewed: 2026-10-10