App Service web apps should require HTTPS for all access
Checks that Azure App Service web apps are only accessible over HTTPS. Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks, so plain HTTP access to the web app is not allowed.
What this control checks
Azure Policy a4af4a39-4135-47fb-b175-47fbdf85311d applies to Microsoft.Web/sites whose kind does not contain functionapp, and applies its effect when Microsoft.Web/sites/httpsOnly does not exist or equals false. Azure Policy 0f98368e-36bc-4716-8ac2-8f8067203b63 uses the Modify effect to addOrReplace Microsoft.Web/sites/httpsOnly with the value true. Checkov CKV_AZURE_14 supports azurerm_app_service, azurerm_linux_web_app and azurerm_windows_web_app and inspects https_only. KICS 11e9a948-c6c3-4a0f-8dcf-b5cf1763cdbe flags azurerm_app_service, azurerm_linux_web_app and azurerm_windows_web_app when https_only is false or missing, and passes when it is true. Trivy AZU-0072 says to set https_only to true on azurerm_app_service. Prowler app_ensure_http_is_redirected_to_https checks that web apps redirect HTTP traffic to HTTPS when the HTTPS Only setting is enabled.
Framework mappings
The clauses this control is mapped to in each framework.
- 1.2.5: Network security controls (NSCs) are configured and maintained.
- 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
- 2.2.7: System components are configured and managed securely.
- 4.2.1: PAN is protected with strong cryptography during transmission.
- 4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- SC-8(1): Cryptographic Protection
- Transmission Confidentiality And Integrity (SC-8)
- 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- 9.2 Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service
- 9.2 Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service
- 9.2 Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service
- 9.2 Ensure Web App Redirects All HTTP traffic to HTTPS in Azure App Service
- 9.2 Ensure Web App Redirects All HTTP traffic to HTTPS in Azure App Service
- 9.1 Ensure 'HTTPS Only' is set to `On`
- 164.312(e)(1) Transmission security
- 164.312(e)(2)(ii) Encryption
Related controls
- App Service apps should have 'Client Certificates (Incoming client certificates)' enabled
- App Service environments should have internal encryption enabled
- Azure Cache for Redis should allow only secure connections
- MySQL servers should have 'Enforce SSL connection' enabled
- PostgreSQL servers should use the latest TLS version
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_use_https - Checkov Check:
CKV_AZURE_14 - Powerpipe Control:
azure_compliance.control.appservice_web_app_use_https - Prowler Check:
app_ensure_http_is_redirected_to_https - Azure Policy Definitions:
0f98368e-36bc-4716-8ac2-8f8067203b63,a4af4a39-4135-47fb-b175-47fbdf85311d - KICS Query:
11e9a948-c6c3-4a0f-8dcf-b5cf1763cdbe - Trivy Check:
AZU-0072
Last reviewed: 2026-10-11