Back to Checks
azure

App Service web app has minimum TLS version set to 1.2 or 1.3

app_minimum_tls_version_12
Service: appSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:microsoft.web/sites/config

Azure App Service web apps are assessed for the configured minimum TLS version for HTTPS. The expected baseline is 1.2 or 1.3; settings that permit lower versions indicate acceptance of legacy TLS during client negotiation.

Prowler logoProwlerprowler-provider-azure

Risk

Allowing TLS 1.0/1.1 enables protocol downgrades and weak cipher negotiation, exposing HTTPS traffic to MITM interception, credential theft, and tampering. This undermines the confidentiality and integrity of sessions and data in transit, and can enable account takeover via stolen tokens.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks app_minimum_tls_version_12

Recommendation

Enforce a minimum of TLS 1.2 (prefer 1.3) and disable 1.0/1.1. Require HTTPS-only, enable HSTS, and align with modern cipher suites. Test client compatibility and phase out legacy agents. Document narrow exceptions with compensating controls to uphold defense in depth and prevent downgrades.

Remediation

CLI

az webapp config set --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --min-tls-version 1.2

Terraform

# Enforce minimum TLS 1.2 on an Azure Linux Web App
resource "azurerm_linux_web_app" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<example_resource_name>"
  service_plan_id     = "<example_resource_id>"

  site_config {
    minimum_tls_version = "1.2" # CRITICAL: Enforces minimum TLS 1.2 to pass the check
  }
}

NativeIaC

// Update existing App Service to enforce minimum TLS 1.2
resource app 'Microsoft.Web/sites@2023-01-01' existing = {
  name: '<example_resource_name>'
}

resource appConfig 'Microsoft.Web/sites/config@2023-01-01' = {
  name: '${app.name}/web'
  properties: {
    minTlsVersion: '1.2' // CRITICAL: Enforces minimum TLS version 1.2 to pass the check
  }
}

Other

1Sign in to Azure Portal and go to App Services
2Select your app
3Go to Settings > Configuration > General settings
4Set Minimum TLS Version to 1.2 (or 1.3 if available)
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.app.app_client import app_client


class app_minimum_tls_version_12(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            apps,
        ) in app_client.apps.items():
            subscription_name = app_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for app in apps.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=app)
                report.subscription = subscription_id
                report.status = "FAIL"
                report.status_extended = f"Minimum TLS version is not set to 1.2 for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."

                if app.configurations and getattr(
                    app.configurations, "min_tls_version", ""
                ) in ["1.2", "1.3"]:
                    report.status = "PASS"
                    report.status_extended = f"Minimum TLS version is set to {app.configurations.min_tls_version} for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."

                findings.append(report)

        return findings

References