Azure Compliance ControlsAzure App Service
App Service web apps should use the latest 'HTTP Version' when used to run the app
Evaluates each Azure App Service web app configuration and reports whether the `http20_enabled` site setting is turned on, so the app serves clients over `HTTP/2` instead of falling back to the older `HTTP/1.1` protocol.
What this control checks
App Service web apps must run on the latest HTTP version available for the app
Framework mappings
The clauses this control is mapped to in each framework.
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- SI-2 Flaw Remediation
- SI-2(6) Removal of Previous Versions of Software and Firmware
- 3.14.1 Identify, report, and correct system flaws in a timely manner
- 9.9 Ensure that 'HTTP Version' is the latest, if used to run the web app
- 9.9 Ensure that 'HTTP Version' is the latest, if used to run the web app
- 9.9 Ensure that 'HTTP Version' is the latest, if used to run the web app
- 9.9 Ensure that 'HTTP Version' is the Latest, if Used to Run the Web App
- 9.8 Ensure that 'HTTP Version' is the Latest, if Used to Run the Web App
- 9.10 Ensure that 'HTTP20enabled' is set to 'true' (if in use)
- SI-2 Flaw Remediation
- 164.312(e)(1) Transmission security
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_latest_http_version - Checkov Check:
CKV_AZURE_18 - Powerpipe Control:
azure_compliance.control.appservice_web_app_latest_http_version - Prowler Check:
app_ensure_using_http20 - Trivy Check:
AZU-0005
Last reviewed: 2026-10-11