Azure Compliance ControlsAzure Functions
Function apps should use the latest TLS version
Periodically, newer versions are released for TLS either due to security flaws, include additional functionality, and enhance speed. Upgrade to the latest TLS version for Function apps to take advantage of security fixes, if any, and/or new functionalities.
What this control checks
Function apps must set minTlsVersion to 1.2 or higher (Azure Policy existence condition).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-8(1): Cryptographic Protection
- Transmission Confidentiality And Integrity (SC-8)
NIST Cybersecurity Framework v2.0
- GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
- PR.DS-02
- 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- 3.1.h Public Key Infrastructure (PKI)
- SC-8 Transmission Confidentiality And Integrity
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 0809.01n2Organizational.1234-01.n 01.04 Network Access Control
- 0810.01n2Organizational.5-01.n 01.04 Network Access Control
- 0811.01n2Organizational.6-01.n 01.04 Network Access Control
- 0812.01n2Organizational.8-01.n 01.04 Network Access Control
- 0814.01n1Organizational.12-01.n 01.04 Network Access Control
1 more clause
- 0949.09y2Organizational.5-09.y 09.09 Electronic Commerce Services
Related controls
- App Service web apps should use the latest TLS version
- Function apps should use the latest 'Python version' when Python is part of the app
- Function apps should not allow CORS access from every resource
- App Service web app slots should require HTTPS for all access
- App Service API apps should require FTPS only
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_function_app_latest_tls_version - Checkov Check:
CKV_AZURE_145 - Powerpipe Control:
azure_compliance.control.appservice_function_app_latest_tls_version - Azure Policy Definitions:
1f01f1c7-539c-49b5-9ef4-d4ffa37d22e0,f9d614c5-c173-4d56-95a7-b4437057d193 - KICS Query:
45fc717a-bd86-415c-bdd8-677901be1aa6
Last reviewed: 2026-10-11