Azure Compliance ControlsAzure App Service
App Service apps should have 'Client Certificates (Incoming client certificates)' enabled
Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app. Prowler checks that client certificate mode is set to Required.
What this control checks
Checks the Client Certificates (Incoming client certificates) setting on App Service apps
Framework mappings
The clauses this control is mapped to in each framework.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 2.2.7: System components are configured and managed securely.
3 more clauses
- 4.2.1: PAN is protected with strong cryptography during transmission.
- 4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained
- 8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 3.8 Digital Signatures
- 9.4 Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On'
- 0662.09sCSPOrganizational.2-09.s 09.08 Exchange of Information
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_client_certificates_on - Checkov Check:
CKV_AZURE_17 - Powerpipe Controls:
azure_compliance.control.appservice_web_app_client_certificates_on,azure_compliance.control.appservice_web_app_incoming_client_cert_on - Prowler Check:
app_client_certificates_on - Trivy Check:
AZU-0001
Last reviewed: 2026-10-11