App Service web apps should require HTTPS for all access
Checks that Azure App Service web apps are only accessible over HTTPS. Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks, so plain HTTP access to the web app is not allowed.
Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks. Leaving HTTP accessible enables man-in-the-middle interception, credential and cookie theft, and response tampering.
What this control checks
App Service web apps must require HTTPS for all access
Common pitfalls
Missing https_only fails the check
KICS flags azurerm_app_service, azurerm_linux_web_app and azurerm_windows_web_app when https_only is false or missing.
Function apps are excluded from the policy
The policy rule applies to Microsoft.Web/sites where kind does not contain functionapp.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Configure App Service apps to only be accessible over HTTPS" (0f98368e-36bc-4716-8ac2-8f8067203b63) and "App Service apps should only be accessible over HTTPS" (a4af4a39-4135-47fb-b175-47fbdf85311d); Prowler check app_ensure_http_is_redirected_to_https (prowler azure --checks app_ensure_http_is_redirected_to_https); PowerPipe control azure_compliance.control.appservice_web_app_use_https.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_14; KICS query "Web App Accepting Traffic Other Than HTTPS" (11e9a948-c6c3-4a0f-8dcf-b5cf1763cdbe); Trivy check AZU-0072.
Framework-specific interpretation
PCI DSS v4.0: Mapped to 1.2.5 (Network security controls (NSCs) are configured and maintained.), 2.2.5 (System components are configured and managed securely.), 2.2.7 (System components are configured and managed securely.) and 2 more clauses.
NIS2 Directive (EU 2022/2555): Mapped to 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;), 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;), 6.2.1 (Before developing a network and information system, including software, the relevant entities shall lay down rules for...) and 4 more clauses.
NIST SP 800-53 Rev 5: Mapped to SC-8 (Transmission Confidentiality and Integrity) and SC-8(1) (Cryptographic Protection).
Framework mappings
The clauses this control is mapped to in each framework.
- 1.2.5: Network security controls (NSCs) are configured and maintained.
- 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
- 2.2.7: System components are configured and managed securely.
- 4.2.1: PAN is protected with strong cryptography during transmission.
- 4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- SC-8(1): Cryptographic Protection
- Transmission Confidentiality And Integrity (SC-8)
- 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- 9.2 Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service
- 9.2 Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service
- 9.2 Ensure web app redirects all HTTP traffic to HTTPS in Azure App Service
- 9.2 Ensure Web App Redirects All HTTP traffic to HTTPS in Azure App Service
- 9.2 Ensure Web App Redirects All HTTP traffic to HTTPS in Azure App Service
- 9.1 Ensure 'HTTPS Only' is set to `On`
- 164.312(e)(1) Transmission security
- 164.312(e)(2)(ii) Encryption
Related controls
- App Service apps should have 'Client Certificates (Incoming client certificates)' enabled
- App Service environments should have internal encryption enabled
- Azure Cache for Redis should allow only secure connections
- MySQL servers should have 'Enforce SSL connection' enabled
- PostgreSQL servers should use the latest TLS version
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_use_https - Checkov Check:
CKV_AZURE_14 - Powerpipe Control:
azure_compliance.control.appservice_web_app_use_https - Prowler Check:
app_ensure_http_is_redirected_to_https - Azure Policy Definitions:
0f98368e-36bc-4716-8ac2-8f8067203b63,a4af4a39-4135-47fb-b175-47fbdf85311d - KICS Query:
11e9a948-c6c3-4a0f-8dcf-b5cf1763cdbe - Trivy Check:
AZU-0072
Last reviewed: 2026-10-11