App Service apps should use the latest TLS version
Periodically, newer versions are released for TLS due to security flaws, additional functionality, and speed. Upgrade to the latest TLS version for App Service apps to take advantage of security fixes and new functionalities.
Allowing TLS 1.0/1.1 enables protocol downgrades and weak cipher negotiation, exposing HTTPS traffic to MITM interception, credential theft, and tampering. This undermines the confidentiality and integrity of sessions and data in transit, and can enable account takeover via stolen tokens.
What this control checks
App Service apps must use the latest TLS version (minimum TLS version 1.2 or 1.3).
Common pitfalls
Service uses TLS 1.2 by default
The service uses TLS 1.2 by default.
Lower versions indicate legacy TLS
Settings that permit lower versions indicate acceptance of legacy TLS during client negotiation.
Audit evidence
Evidence that deployed resources meet this control: Prowler check app_minimum_tls_version_12 (prowler azure --checks app_minimum_tls_version_12); PowerPipe controls azure_compliance.control.appservice_api_app_latest_tls_version and azure_compliance.control.appservice_web_app_latest_tls_version.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_15; KICS query "App Service Not Using Latest TLS Encryption Version" (b7b9d1c7-2d3b-49b4-b867-ebbe68d0b643); Trivy check AZU-0006.
Framework-specific interpretation
SOC 2: Mapped to CC6.6 (The entity implements logical access security measures to protect against threats from sources outside its system...) and CC6.7 (The entity restricts the transmission, movement, and removal of information to authorized internal and external users...).
PCI DSS v4.0: Mapped to 1.2.5 (Network security controls (NSCs) are configured and maintained.), 2.2.5 (System components are configured and managed securely.), 2.2.7 (System components are configured and managed securely.) and 2 more clauses.
ISO/IEC 27001:2022: Mapped to A.8.12 (Data Leakage Prevention) and A.8.24 (Use of Cryptography).
NIS2 Directive (EU 2022/2555): Mapped to 12.2.2.b (provide rules on the safe use, safe storage, safe transport, and the irretrievable deletion and destruction of the...), 12.2.2.c (provide that the transfer shall take place in a secure manner, in accordance with the type of asset to be transferred.), 2.1.2.g (identify and prioritise appropriate risk treatment options and measures;) and 7 more clauses.
NIST SP 800-53 Rev 5: Mapped to SC-8 (Transmission Confidentiality and Integrity) and SC-8(1) (Cryptographic Protection).
NIST Cybersecurity Framework v2.0: Mapped to GV.OC-03 (Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties...) and PR.DS-02 (The confidentiality, integrity, and availability of data-in-transit are protected.).
Framework mappings
The clauses this control is mapped to in each framework.
- CC6.6: The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives
- 1.2.5: Network security controls (NSCs) are configured and maintained.
- 2.2.5: System components cannot be compromised by exploiting insecure services, protocols, or daemons
- 2.2.7: System components are configured and managed securely.
- 4.2.1: PAN is protected with strong cryptography during transmission.
- 4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained
- A.8.12 Data leakage prevention
- A.8.24 Use of cryptography
- 2 Risk management policy
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 12 Asset management
- SC-8(1): Cryptographic Protection
- Transmission Confidentiality And Integrity (SC-8)
NIST Cybersecurity Framework v2.0
- GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity -- including privacy and civil liberties obligations -- are understood and managed.
- PR.DS-02
- 3.13.8: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- 3.1.h Public Key Infrastructure (PKI)
- COS-08.02B Technical measures outlined in the documented policies and instructions to protect the transmission of data are implemented. These measures are regularly verified to maintain their operating effectiveness.
- CRY-04.01AS The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of all data.
- CRY-04.01B The cloud service provider has established procedures and technical measures for state-of-the-art encryption and authentication for the transmission of cloud service customer data and cloud service derived data both to or by the cloud service provider over public networks. The cloud...
- 9.3 Ensure Web App is using the latest version of TLS encryption
- 9.3 Ensure Web App is using the latest version of TLS encryption
- 9.4 Ensure Web App is using the latest version of TLS encryption
- SC-8 Transmission Confidentiality And Integrity
- SC-8(1) Cryptographic Or Alternate Physical Protection
- 0809.01n2Organizational.1234-01.n 01.04 Network Access Control
- 0810.01n2Organizational.5-01.n 01.04 Network Access Control
- 0811.01n2Organizational.6-01.n 01.04 Network Access Control
- 0812.01n2Organizational.8-01.n 01.04 Network Access Control
- 0814.01n1Organizational.12-01.n 01.04 Network Access Control
1 more clause
- 0949.09y2Organizational.5-09.y 09.09 Electronic Commerce Services
- 164.312(e)(1) Transmission security
- 164.312(e)(2)(ii) Encryption
Related controls
- App Service web apps should use the latest TLS version
- Function apps should use the latest 'HTTP Version' when used to run the app
- MySQL flexible servers should have 'require_secure_transport' set to 'ON'
- App Service apps should use a virtual network service endpoint
- Function apps should use the latest 'Java version' when Java is part of the app
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_api_app_latest_tls_version - Checkov Check:
CKV_AZURE_15 - Powerpipe Controls:
azure_compliance.control.appservice_api_app_latest_tls_version,azure_compliance.control.appservice_web_app_latest_tls_version - Prowler Check:
app_minimum_tls_version_12 - KICS Query:
b7b9d1c7-2d3b-49b4-b867-ebbe68d0b643 - Trivy Check:
AZU-0006
Last reviewed: 2026-10-10