Function App should only be accessible over HTTPS

What does the recommendation "Function App should only be accessible over HTTPS" check?

Flags any Function App where the 'HTTPS Only' setting (the 'httpsOnly' property on the Microsoft.Web/sites resource) is off, so the app still answers plain HTTP on port 80 instead of redirecting callers to HTTPS. The check is binary: it confirms only that unencrypted requests are refused and redirected. It does not inspect the negotiated TLS version, so an app can pass this control while still accepting the deprecated TLS 1.0 or 1.1; it does not validate custom-domain certificates; and it does not cover client-certificate (mutual TLS) requirements. Each deployment slot is a separate site, so a staging or pre-production slot can still fail even when the production slot is compliant.

Why does "Function App should only be accessible over HTTPS" matter?

An HTTP endpoint lets function keys, bearer tokens and request payloads travel as cleartext, so anyone positioned on the network path, public Wi-Fi, a compromised proxy or a hostile ISP, can read or tamper with them. A Function App is frequently an API backend or a webhook handler, and a captured function key grants an attacker the same invocation rights as a legitimate client. Stolen request data can include personal or payment details, turning a quiet eavesdrop into a reportable breach with regulatory and contractual fallout. Even where a load balancer terminates TLS in front of the app, leaving HTTP open invites a downgrade or man-in-the-middle attack on the first hop. Turning on HTTPS Only makes the platform return a redirect for every HTTP request, closing the cleartext window without touching application code or redeploying the function.

How do I fix "Function App should only be accessible over HTTPS"?

1. Set the 'HTTPS Only' toggle to On under Settings then Configuration (General settings) in the portal, or run 'az functionapp update --name <app> --resource-group <rg> --set httpsOnly=true'. In Bicep or ARM, set 'httpsOnly: true' in the properties block of the Microsoft.Web/sites resource so redeployments cannot silently revert it.
2. While you are there, raise 'siteConfig.minTlsVersion' to '1.2' (or '1.3'); HTTPS Only alone still permits weak legacy TLS, and this control will not catch that gap.
3. Confirm that any caller, webhook source or front-end origin uses the https:// URL before enforcing, then test that an http:// request returns a 301 to https. Bake the setting into your IaC module defaults so every new Function App ships secure rather than relying on a manual post-deploy step.

# Close the highest-impact plaintext doors first: the Redis non-SSL port,
# then HTTPS-only + a modern TLS floor on every web app.

# Redis: disable the non-SSL port 6379 and require TLS 1.2 (clients use 6380).
for cache in $(az redis list --query "[?enableNonSslPort].name" -o tsv); do
  rg=$(az redis list --query "[?name=='$cache'].resourceGroup" -o tsv)
  az redis update --name "$cache" --resource-group "$rg" \
    --set enableNonSslPort=false minimumTlsVersion=1.2
  echo "$cache: non-SSL port disabled, min TLS 1.2"
done

# Web apps: enforce HTTPS only and raise the TLS floor.
for app in $(az webapp list --query "[?httpsOnly==\`false\`].name" -o tsv); do
  rg=$(az webapp list --query "[?name=='$app'].resourceGroup" -o tsv)
  az webapp update --name "$app" --resource-group "$rg" --https-only true
  az webapp config set --name "$app" --resource-group "$rg" --min-tls-version 1.2
  echo "$app: HTTPS only, min TLS 1.2"
done

# Functions follow the same pattern with az functionapp update --set httpsOnly=true.

# Ratchet it shut: assign the built-in deny policy for web apps over HTTPS only.
az policy assignment create \
  --name require-https-webapp \
  --policy a4af4a39-4135-47fb-b175-47fbdf85311d \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"