Function apps should require HTTPS for all access
Function apps should only be accessible over HTTPS. Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. By default, clients can connect to function endpoints by using both HTTP or HTTPS.
Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. Leaving HTTP accessible on a Function app enables man-in-the-middle interception, credential and token theft, and response tampering.
What this control checks
Function apps must require HTTPS for all access
Common pitfalls
Function apps accept HTTP and HTTPS by default
By default, clients can connect to function endpoints by using both HTTP or HTTPS.
The https_only setting defaults to false
The default for https_only is false.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Function apps should only be accessible over HTTPS" (6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab) and "Configure Function apps to only be accessible over HTTPS" (a096cbd0-4693-432f-9374-682f485f23f3); Prowler check app_function_ensure_http_is_redirected_to_https (prowler azure --checks app_function_ensure_http_is_redirected_to_https); PowerPipe control azure_compliance.control.appservice_function_app_only_https_accessible.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_70; Trivy check AZU-0004.
Framework-specific interpretation
NIST SP 800-53 Rev 5: Mapped to SC-8 (Transmission Confidentiality and Integrity) and SC-8(1) (Cryptographic Protection).
NIST Cybersecurity Framework v2.0: Mapped to GV.OC-03 (Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties...) and PR.DS-02 (The confidentiality, integrity, and availability of data-in-transit are protected.).
Framework mappings
The clauses this control is mapped to in each framework.
- SC-8(1): Cryptographic Protection
- Transmission Confidentiality And Integrity (SC-8)
NIST Cybersecurity Framework v2.0
- GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
- PR.DS-02
- 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
- 3.1.h Public Key Infrastructure (PKI)
- SC-8 Transmission Confidentiality And Integrity
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 0809.01n2Organizational.1234-01.n 01.04 Network Access Control
- 0810.01n2Organizational.5-01.n 01.04 Network Access Control
- 0811.01n2Organizational.6-01.n 01.04 Network Access Control
- 0812.01n2Organizational.8-01.n 01.04 Network Access Control
- 0814.01n1Organizational.12-01.n 01.04 Network Access Control
1 more clause
- 0949.09y2Organizational.5-09.y 09.09 Electronic Commerce Services
- 6.5.3: Insecure cryptographic storage.
- Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using approaches like one-way hashes based on strong cryptography, truncation etc
- Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_function_app_only_https_accessible - Checkov Check:
CKV_AZURE_70 - Powerpipe Control:
azure_compliance.control.appservice_function_app_only_https_accessible - Prowler Check:
app_function_ensure_http_is_redirected_to_https - Azure Policy Definitions:
6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab,a096cbd0-4693-432f-9374-682f485f23f3 - Trivy Check:
AZU-0004
Last reviewed: 2026-10-11