App Service web apps should have 'Client Certificates (Incoming client certificates)' set to 'On'
Client certificates allow for the app to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the app.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "App Service apps should have Client Certificates (Incoming client certificates) enabled" (5c8eef54-2020-4bd6-921c-7470989dee37); Prowler check app_client_certificates_on (prowler azure --checks app_client_certificates_on); PowerPipe control azure_compliance.control.appservice_web_app_incoming_client_cert_on.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_17; Trivy check AZU-0001.
Framework-specific interpretation
PCI DSS v4.0: Mapped to 1.2.8 (Network security controls (NSCs) are configured and maintained.), 1.3.1 (Network access to and from the cardholder data environment is restricted.), 1.3.2 (Network access to and from the cardholder data environment is restricted.) and 5 more clauses.
NIS2 Directive (EU 2022/2555): Mapped to 5.1.2.a (the cybersecurity practices of the suppliers and service providers, including their secure development procedures;), 6.2.1 (Before developing a network and information system, including software, the relevant entities shall lay down rules for...), 6.2.2.b (apply principles for engineering secure systems and secure coding principles to any information system development...) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 1.2.8: Network security controls (NSCs) are configured and maintained.
- 1.3.1: Network access to and from the cardholder data environment is restricted.
- 1.3.2: Network access to and from the cardholder data environment is restricted.
- 1.4.2: Network connections between trusted and untrusted networks are controlled.
- 2.2.7: System components are configured and managed securely.
3 more clauses
- 4.2.1: PAN is protected with strong cryptography during transmission.
- 4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained
- 8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components
- 5 Supply chain security
- 6 Security in network and information systems acquisition, development and maintenance
- 9 Cryptography
- 3.4.1 Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles
- 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems
- 9.4 Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On'
- 9.4 Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On'
- 9.4 Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On'
- 9.4 Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_incoming_client_cert_on - Checkov Check:
CKV_AZURE_17 - Powerpipe Control:
azure_compliance.control.appservice_web_app_incoming_client_cert_on - Prowler Check:
app_client_certificates_on - Azure Policy Definition:
5c8eef54-2020-4bd6-921c-7470989dee37 - Trivy Check:
AZU-0001
Last reviewed: 2026-10-11