App Service web apps should use the latest TLS version
Upgrade to the latest TLS version. Azure Policy audits App Service apps where `Microsoft.Web/sites/config/minTlsVersion` is not greater or equal to `1.2`. Prowler expects a minimum TLS version of 1.2 or 1.3 for web apps.
Allowing TLS 1.0/1.1 enables protocol downgrades and weak cipher negotiation, exposing HTTPS traffic to MITM interception, credential theft, and tampering.
What this control checks
Checks the TLS version setting on each App Service web app
Common pitfalls
Function apps are excluded from the policy
The policy applies to Microsoft.Web/sites where kind does not contain functionapp.
Missing site_config block passes in Checkov
The Checkov check sets missing_block_result=CheckResult.PASSED. The Checkov check accepts 1.2 or 1.3.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Configure App Service apps to use the latest TLS version" (ae44c1d1-0df2-4ca9-98fa-a3d3ae5b409d) and "App Service apps should use the latest TLS version" (f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b); Prowler check app_minimum_tls_version_12 (prowler azure --checks app_minimum_tls_version_12); PowerPipe control azure_compliance.control.appservice_web_app_latest_tls_version.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_15; KICS query "App Service Not Using Latest TLS Encryption Version" (b7b9d1c7-2d3b-49b4-b867-ebbe68d0b643); Trivy check AZU-0006.
Framework-specific interpretation
SOC 2: Mapped to CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...) and CC6.7 (The entity restricts the transmission, movement, and removal of information to authorized internal and external users...).
PCI DSS v4.0: Mapped to 1.2.5 (Network security controls (NSCs) are configured and maintained.), 2.2.5 (System components are configured and managed securely.), 2.2.7 (System components are configured and managed securely.) and 3 more clauses.
ISO/IEC 27001:2022: Mapped to A.8.12 (Data Leakage Prevention), A.8.24 (Use of Cryptography) and A.8.5 (Secure Authentication).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.b (provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the...), 12.2.2.c (provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.), 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;) and 7 more clauses.
NIST Cybersecurity Framework v2.0: Mapped to GV.OC-03 (Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties...) and PR.DS-02 (The confidentiality, integrity, and availability of data-in-transit are protected.).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives
- 1.2.5: Network security controls (NSCs) are configured and maintained.
- 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
- 2.2.7: System components are configured and managed securely.
- 4.2.1: PAN is protected with strong cryptography during transmission.
- 4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained
1 more clause
- 8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components
- A.8.5 Secure authentication
- A.8.12 Data leakage prevention
- A.8.24 Use of cryptography
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 12 Asset management
NIST Cybersecurity Framework v2.0
- GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
- PR.DS-02
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness.
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- 9.3 Ensure web app is using the latest version of TLS encryption
- 9.3 Ensure web app is using the latest version of TLS encryption
- 9.3 Ensure web app is using the latest version of TLS encryption
- 9.3 Ensure Web App is using the latest version of TLS encryption
- 9.3 Ensure Web App is using the latest version of TLS encryption
- 9.4 Ensure Web App is using the latest version of TLS encryption
- 164.312(e)(1) Transmission security
- 164.312(e)(2)(ii) Encryption
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_latest_tls_version - Checkov Check:
CKV_AZURE_15 - Powerpipe Control:
azure_compliance.control.appservice_web_app_latest_tls_version - Prowler Check:
app_minimum_tls_version_12 - Azure Policy Definitions:
ae44c1d1-0df2-4ca9-98fa-a3d3ae5b409d,f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b - KICS Query:
b7b9d1c7-2d3b-49b4-b867-ebbe68d0b643 - Trivy Check:
AZU-0006
Last reviewed: 2026-10-11