App Service apps should have 'Client Certificates (Incoming client certificates)' enabled
Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "App Service apps should have Client Certificates (Incoming client certificates) enabled" (5c8eef54-2020-4bd6-921c-7470989dee37); Prowler check app_client_certificates_on (prowler azure --checks app_client_certificates_on); PowerPipe controls azure_compliance.control.appservice_web_app_client_certificates_on and azure_compliance.control.appservice_web_app_incoming_client_cert_on.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_17; Trivy check AZU-0001.
Framework-specific interpretation
PCI DSS v4.0: Mapped to 1.2.8 (Network security controls (NSCs) are configured and maintained.), 1.3.1 (Network access to and from the cardholder data environment is restricted.), 1.3.2 (Network access to and from the cardholder data environment is restricted.) and 5 more clauses.
NIS2 Directive (EU 2022/2555): Mapped to 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;), 6.2.1 (Before developing a network and information system, including software, the relevant entities shall lay down rules for...), 6.2.2.b (apply principles for engineering secure systems and secure coding principles to any information system development...) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 2.2.7: System components are configured and managed securely.
3 more clauses
- 4.2.1: PAN is protected with strong cryptography during transmission.
- 4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained
- 8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 3.8 Digital Signatures
- 9.4 Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On'
- 0662.09sCSPOrganizational.2-09.s 09.08 Exchange of Information
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_client_certificates_on - Checkov Check:
CKV_AZURE_17 - Powerpipe Controls:
azure_compliance.control.appservice_web_app_client_certificates_on,azure_compliance.control.appservice_web_app_incoming_client_cert_on - Prowler Check:
app_client_certificates_on - Azure Policy Definition:
5c8eef54-2020-4bd6-921c-7470989dee37 - Trivy Check:
AZU-0001
Last reviewed: 2026-10-11