Azure Compliance ControlsAzure Functions
Function apps should require HTTPS for all access
Function apps should only be accessible over HTTPS. Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. By default, clients can connect to function endpoints by using both HTTP or HTTPS.
What this control checks
Function apps must require HTTPS for all access
Framework mappings
The clauses this control is mapped to in each framework.
- SC-8(1): Cryptographic Protection
- Transmission Confidentiality And Integrity (SC-8)
NIST Cybersecurity Framework v2.0
- GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
- PR.DS-02
- 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- 3.1.h Public Key Infrastructure (PKI)
- SC-8 Transmission Confidentiality And Integrity
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 0809.01n2Organizational.1234-01.n 01.04 Network Access Control
- 0810.01n2Organizational.5-01.n 01.04 Network Access Control
- 0811.01n2Organizational.6-01.n 01.04 Network Access Control
- 0812.01n2Organizational.8-01.n 01.04 Network Access Control
- 0814.01n1Organizational.12-01.n 01.04 Network Access Control
1 more clause
- 0949.09y2Organizational.5-09.y 09.09 Electronic Commerce Services
- 6.5.3: Insecure cryptographic storage.
- Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using approaches like one-way hashes based on strong cryptography, truncation etc
- Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_function_app_only_https_accessible - Checkov Check:
CKV_AZURE_70 - Powerpipe Control:
azure_compliance.control.appservice_function_app_only_https_accessible - Prowler Check:
app_function_ensure_http_is_redirected_to_https - Azure Policy Definitions:
6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,a096cbd0-4693-432f-9374-682f485f23f3 - Trivy Check:
AZU-0004
Last reviewed: 2026-10-11