Azure Compliance ControlsAzure App Service
App Service web apps should have 'Client Certificates (Incoming client certificates)' set to 'On'
Checks that App Service web apps have `Client Certificates (Incoming client certificates)` set to `On`. With it enabled, only clients presenting a valid certificate can reach the app, so only an authenticated client gets access.
What this control checks
Only clients with valid certificates can reach the app
Framework mappings
The clauses this control is mapped to in each framework.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 2.2.7: System components are configured and managed securely.
3 more clauses
- 4.2.1: PAN is protected with strong cryptography during transmission.
- 4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained
- 8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- 9.4 Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On'
- 9.4 Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On'
- 9.4 Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On'
- 9.4 Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_incoming_client_cert_on - Checkov Check:
CKV_AZURE_17 - Powerpipe Control:
azure_compliance.control.appservice_web_app_incoming_client_cert_on - Prowler Check:
app_client_certificates_on - Trivy Check:
AZU-0001
Last reviewed: 2026-10-11