Web Application should only be accessible over HTTPS

What does the recommendation "Web Application should only be accessible over HTTPS" check?

Flags any App Service app, function app or web app slot where the 'HTTPS Only' setting (the 'httpsOnly' property on the Microsoft.Web/sites resource) is off, so the app still answers plain HTTP requests on port 80 instead of redirecting them to HTTPS. It checks only that this single redirect toggle is enabled. It does not verify the minimum TLS version, validate the certificate, inspect access restriction or inbound traffic rules, or cover client-certificate or end-to-end in-transit settings, all of which are governed by separate App Service controls. A deployment slot is evaluated independently of its production slot, so a slot can pass while production fails or the reverse.

Why does "Web Application should only be accessible over HTTPS" matter?

With 'HTTPS Only' off, the app keeps serving over unencrypted HTTP, so session cookies, bearer tokens and form data can be read or altered by anyone able to observe the network path, and an attacker on the same path can downgrade or man-in-the-middle the connection before any redirect happens in the application code. A leaked authentication token from one cleartext request is enough to impersonate a user or replay the session. Customers also increasingly fail audits and lose deals when a scan finds a public endpoint serving HTTP, so the business consequence is regulatory and commercial, not just technical. Enforcing the redirect at the platform level closes the plaintext path entirely, so an attacker cannot reach the app over HTTP at all rather than relying on every request first hitting an in-app redirect that a developer might forget to add.

How do I fix "Web Application should only be accessible over HTTPS"?

1. Turn the toggle on per app: in the portal open the App Service, go to Settings then Configuration (General settings), and set 'HTTPS Only' to On; or run 'az webapp update --resource-group <rg> --name <app> --set httpsOnly=true' and confirm with 'az webapp show ... --query httpsOnly'.
2. Bake it into infrastructure as code so new apps ship secure: set 'httpsOnly: true' under the Microsoft.Web/sites resource in Bicep or ARM (or the equivalent in Terraform) rather than fixing each app by hand after deployment.
3. If you have many subscriptions or want to stop drift, assign the built-in Azure Policy that enforces HTTPS for App Service in DeployIfNotExists or Append mode so the setting is applied or remediated automatically across the estate.

# Close the highest-impact plaintext doors first: the Redis non-SSL port,
# then HTTPS-only + a modern TLS floor on every web app.

# Redis: disable the non-SSL port 6379 and require TLS 1.2 (clients use 6380).
for cache in $(az redis list --query "[?enableNonSslPort].name" -o tsv); do
  rg=$(az redis list --query "[?name=='$cache'].resourceGroup" -o tsv)
  az redis update --name "$cache" --resource-group "$rg" \
    --set enableNonSslPort=false minimumTlsVersion=1.2
  echo "$cache: non-SSL port disabled, min TLS 1.2"
done

# Web apps: enforce HTTPS only and raise the TLS floor.
for app in $(az webapp list --query "[?httpsOnly==\`false\`].name" -o tsv); do
  rg=$(az webapp list --query "[?name=='$app'].resourceGroup" -o tsv)
  az webapp update --name "$app" --resource-group "$rg" --https-only true
  az webapp config set --name "$app" --resource-group "$rg" --min-tls-version 1.2
  echo "$app: HTTPS only, min TLS 1.2"
done

# Functions follow the same pattern with az functionapp update --set httpsOnly=true.

# Ratchet it shut: assign the built-in deny policy for web apps over HTTPS only.
az policy assignment create \
  --name require-https-webapp \
  --policy a4af4a39-4135-47fb-b175-47fbdf85311d \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"