Storage accounts should have 'Minimum TLS version' set to 'Version 1.2'
Storage accounts should have the specified minimum TLS version. Azure Policy asks for a minimum TLS version for secure communication between the client application and the storage account. The recommended minimum is TLS 1.2.
Allowing TLS 1.0 / 1.1 enables protocol downgrades and exploitation of known flaws (e.g., BEAST), weakening confidentiality and integrity. Attackers can intercept or modify data in transit and harvest credentials via weakened cipher suites.
What this control checks
Checks the Minimum TLS version setting on each storage account
Common pitfalls
TLS 1.0 and TLS 1.1 still supported
Azure Storage uses TLS 1.2 or TLS 1.3 on public HTTPS endpoints, while TLS 1.0 and TLS 1.1 are still supported for backward compatibility.
Setting must exist and match
The policy audits storage accounts where minimumTlsVersion does not equal the minimumTlsVersion parameter or does not exist.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Storage accounts should have the specified minimum TLS version" (fe83a0eb-a853-422d-aac2-1bffd182c5d0); Prowler check storage_ensure_minimum_tls_version_12 (prowler azure --checks storage_ensure_minimum_tls_version_12); PowerPipe control azure_compliance.control.storage_account_min_tls_1_2.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_44; KICS query "Storage Account Not Using Latest TLS Encryption Version" (8263f146-5e03-43e0-9cfe-db960d56d1e7); Trivy checks AZU-0011 and AZU-0059.
Framework-specific interpretation
SOC 2: Mapped to CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.a (cover the entire life cycle of the assets, including acquisition, use, storage, transportation and disposal;), 12.2.2.c (provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.), 6.7.2.i (establish communication between distinct systems only through trusted channels that are isolated using logical...) and 1 more clause.
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- 6 Security in network and information systems acquisition, development and maintenance
- 12 Asset management
- 10.3.7 Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2'
- 9.3.6 Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2'
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness.
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- IAM-09.03B Within the production environment, user authentication takes place through passwords, digitally signed certificates or procedures that achieve at least an equivalent level of security. If digitally signed certificates are used, administration is carried out in accordance with the...
- OPS-23.01B The cloud service provider regularly measures, analyses and assesses the procedures with which vulnerabilities and incidents are handled to verify their continued suitability, appropriateness and effectiveness.
- 3.12 Ensure the 'Minimum TLS version' is set to 'Version 1.2'
- 3.15 Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2'
- 3.15 Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2'
- 3.15 Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2'
- 4.15 Ensure the 'Minimum TLS version' for storage accounts is set to 'Version 1.2'
- 164.312(e)(1) Transmission security
- 164.312(e)(2)(i) Integrity controls
- 164.312(e)(2)(ii) Encryption
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
storage_account_min_tls_1_2 - Checkov Check:
CKV_AZURE_44 - Powerpipe Control:
azure_compliance.control.storage_account_min_tls_1_2 - Prowler Check:
storage_ensure_minimum_tls_version_12 - Azure Policy Definition:
fe83a0eb-a853-422d-aac2-1bffd182c5d0 - KICS Query:
8263f146-5e03-43e0-9cfe-db960d56d1e7 - Trivy Checks:
AZU-0011,AZU-0059
Last reviewed: 2026-10-15