App Service web app slots should require HTTPS for all access
Checks that Azure App Service web app slots are only accessible over HTTPS. Using HTTPS ensures server and service authentication and protects data in transit from network layer eavesdropping attacks on traffic sent to the slot.
Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.
What this control checks
App Service web app slots must be set to require HTTPS for all access
Common pitfalls
httpsOnly missing or false fails the check
The policy flags Microsoft.Web/sites/slots where Microsoft.Web/sites/slots/httpsOnly exists is false or equals false.
Function app slots are excluded
The policy rule applies only where kind notContains functionapp.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definitions "Configure App Service app slots to only be accessible over HTTPS" (a18c77f2-3d6d-497a-9f61-849a7e8a3b79) and "App Service app slots should only be accessible over HTTPS" (ae1b9a8c-dfce-4605-bd91-69213b4a26fc); PowerPipe control azure_compliance.control.appservice_web_app_slot_use_https.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_153.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
appservice_web_app_slot_use_https - Checkov Check:
CKV_AZURE_153 - Powerpipe Control:
azure_compliance.control.appservice_web_app_slot_use_https - Azure Policy Definitions:
a18c77f2-3d6d-497a-9f61-849a7e8a3b79,ae1b9a8c-dfce-4605-bd91-69213b4a26fc
Last reviewed: 2026-10-11