API Management APIs should use only encrypted protocols

What does the recommendation "API Management APIs should use only encrypted protocols" check?

Flags any API published through an API Management instance whose 'protocols' property still lists the plaintext schemes 'http' or 'ws' instead of only the encrypted 'https' and 'wss'. The check is per API, so a single instance can pass on most APIs and still fail on one legacy definition. It looks only at the protocols a given API is exposed on through the gateway. It does not inspect the minimum TLS version or the cipher suites the gateway negotiates, it does not check the protocol used between the gateway and your backend service, and it does not cover the management API, the SCM endpoint or the developer portal. An API set to encrypted protocols can therefore still pass here while accepting weak ciphers, so treat this control as one layer rather than a full transport hardening review.

Why does "API Management APIs should use only encrypted protocols" matter?

An API that accepts 'http' or 'ws' will answer requests over an unencrypted channel, so bearer tokens, subscription keys and the request and response bodies travel in clear text. Anyone able to observe the path, a compromised proxy, a misconfigured load balancer or an attacker on a shared network, can read or replay that traffic. Because the subscription key is often the only credential, capturing one plaintext call can hand an attacker durable access to the whole API. Restricting each API to 'https' and 'wss' removes the unencrypted entry point entirely, so a client cannot accidentally downgrade and an attacker cannot coax the gateway into answering over a channel they can sniff.

How do I fix "API Management APIs should use only encrypted protocols"?

1. List the offending APIs, then update each one to encrypted schemes only: az apim api update --resource-group <rg> --service-name <apim> --api-id <api-id> --protocols https. For WebSocket APIs pass --protocols https wss so the secure WebSocket scheme is retained.
2. In your Bicep or ARM definitions for Microsoft.ApiManagement/service/apis, set the protocols array to [ 'https' ] (add 'wss' only for WebSocket APIs) so redeployments never reintroduce a plaintext listener.
3. Assign the built-in policy 'API Management APIs should use only encrypted protocols' in Deny mode to block any future API created with http or ws. Look the definition up by display name rather than pasting a GUID: pid=$(az policy definition list --query "[?displayName=='API Management APIs should use only encrypted protocols'].name" -o tsv); az policy assignment create --name apim-encrypted-protocols --policy "$pid" --scope <scope>.

# Close the highest-impact plaintext doors first: the Redis non-SSL port,
# then HTTPS-only + a modern TLS floor on every web app.

# Redis: disable the non-SSL port 6379 and require TLS 1.2 (clients use 6380).
for cache in $(az redis list --query "[?enableNonSslPort].name" -o tsv); do
  rg=$(az redis list --query "[?name=='$cache'].resourceGroup" -o tsv)
  az redis update --name "$cache" --resource-group "$rg" \
    --set enableNonSslPort=false minimumTlsVersion=1.2
  echo "$cache: non-SSL port disabled, min TLS 1.2"
done

# Web apps: enforce HTTPS only and raise the TLS floor.
for app in $(az webapp list --query "[?httpsOnly==\`false\`].name" -o tsv); do
  rg=$(az webapp list --query "[?name=='$app'].resourceGroup" -o tsv)
  az webapp update --name "$app" --resource-group "$rg" --https-only true
  az webapp config set --name "$app" --resource-group "$rg" --min-tls-version 1.2
  echo "$app: HTTPS only, min TLS 1.2"
done

# Functions follow the same pattern with az functionapp update --set httpsOnly=true.

# Ratchet it shut: assign the built-in deny policy for web apps over HTTPS only.
az policy assignment create \
  --name require-https-webapp \
  --policy a4af4a39-4135-47fb-b175-47fbdf85311d \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"