App Service web apps should use the latest 'Python version' when Python is part of the app
Checks that Azure App Service web apps using Python run the latest `Python version`. Newer Python versions are released to fix security flaws or add functionality, so running the latest release keeps the app current with those fixes and features.
What this control checks
Azure Policy 7008174a-fd10-4ef0-817e-fc820a951d73 checks Microsoft.Web/sites/config web.linuxFxVersion on Linux sites, and passes if it does not contain PYTHON or equals PYTHON| plus the LinuxPythonVersion parameter. Powerpipe appservice_web_app_latest_python_version uses a default latest python version of PYTHON|3.13. Prowler app_ensure_python_version_is_latest reads the app's stack configuration to detect Python usage and compares the configured runtime against the defined latest baseline.
Framework mappings
The clauses this control is mapped to in each framework.
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
RBI Cyber Security Framework for UCBs
- Annex I (6)
- DEV-02.01B In the case of outsourced development of the cloud service (or individual system components), specifications regarding the following aspects are contractually agreed between the cloud service provider and the outsourced development contractor: - Security in software development...
- OPS-05.01AS If protection programmes are set up with signature and behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at the highest frequency that the vendor(s) contractually offer(s).
- OPS-05.02B If protection programmes are set up with signature or behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at least on a daily basis.
- OPS-23.01B The cloud service provider regularly measures, analyses and assesses the procedures with which vulnerabilities and incidents are handled to verify their continued suitability, appropriateness and effectiveness.
- OPS-27.01B The cloud service provider documents, communicates, and maintains processes and procedures to manage updates to system components used to provide the cloud service that incorporate third party or open-source libraries. This includes: - Regularly identifying available updates and known...
1 more clause
- OPS-33.02B Patch management procedures are harmonised with the cloud service provider's overall software change management process.
- 9.7 Ensure that 'Python version' is the Latest Stable Version, if Used to Run the Web App
- 9.6 Ensure that 'Python version' is the Latest Stable Version, if Used to Run the Web App
- 9.8 Ensure that 'Python version' is currently supported (if in use)
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_latest_python_version - Powerpipe Control:
azure_compliance.control.appservice_web_app_latest_python_version - Prowler Check:
app_ensure_python_version_is_latest - Azure Policy Definition:
7008174a-fd10-4ef0-817e-fc820a951d73
Last reviewed: 2026-10-11