TLS should be updated to the latest version for function apps

What does the recommendation "TLS should be updated to the latest version for function apps" check?

Flags any function app whose inbound minimum TLS version (the 'minTlsVersion' property in siteConfig) is set to 1.0 or 1.1 rather than 1.2 or higher, so the app still accepts handshakes over a legacy protocol. It inspects only the main application endpoint. It does not evaluate the SCM/Kudu deployment site, which has a separate 'scmMinTlsVersion' property the built-in policy leaves untouched, and it says nothing about the cipher suites negotiated, the certificate in use, or whether HTTPS-only redirection is enforced. A function app can therefore pass this check and still accept plain HTTP on a custom domain, so treat it as one layer of the transport posture rather than the whole of it.

Why does "TLS should be updated to the latest version for function apps" matter?

TLS 1.0 and 1.1 carry known weaknesses such as BEAST and POODLE and rely on outdated cipher constructions that a network attacker can exploit to downgrade or decrypt traffic to your function app. If those endpoints handle API payloads, webhooks or event data, a successful downgrade exposes credentials and customer data in transit and breaks the assumption auditors make about encrypted channels. Beyond the live risk, Microsoft retires inbound TLS 1.0 and 1.1 for Azure Functions on 31 May 2027, so any app still pinned to them will start failing handshakes outright. Raising the floor to 1.2 closes the exposure and keeps the workload supported.

How do I fix "TLS should be updated to the latest version for function apps"?

1. In the portal, open the function app, go to Settings then Configuration and the General settings tab, and set 'Minimum Inbound TLS Version' to 1.2, or run 'az functionapp config set --resource-group <rg> --name <app> --min-tls-version 1.2'.
2. Pin the value in infrastructure as code so it cannot drift back: in Bicep set 'siteConfig.minTlsVersion: '1.2'' on the Microsoft.Web/sites resource, and where deployment tooling targets the SCM site set 'scmMinTlsVersion: '1.2'' as well, since the audit does not cover it.
3. To remediate at scale, assign the built-in DeployIfNotExists policy 'Configure Function apps to use the latest TLS version', looking the definition up by name rather than pasting a GUID: pid=$(az policy definition list --query "[?displayName=='Configure Function apps to use the latest TLS version'].name" -o tsv); az policy assignment create --name funcapp-tls-12 --policy "$pid" --scope <scope> --location <region> --mi-system-assigned, then trigger a remediation task so existing apps are corrected.

# Close the highest-impact plaintext doors first: the Redis non-SSL port,
# then HTTPS-only + a modern TLS floor on every web app.

# Redis: disable the non-SSL port 6379 and require TLS 1.2 (clients use 6380).
for cache in $(az redis list --query "[?enableNonSslPort].name" -o tsv); do
  rg=$(az redis list --query "[?name=='$cache'].resourceGroup" -o tsv)
  az redis update --name "$cache" --resource-group "$rg" \
    --set enableNonSslPort=false minimumTlsVersion=1.2
  echo "$cache: non-SSL port disabled, min TLS 1.2"
done

# Web apps: enforce HTTPS only and raise the TLS floor.
for app in $(az webapp list --query "[?httpsOnly==\`false\`].name" -o tsv); do
  rg=$(az webapp list --query "[?name=='$app'].resourceGroup" -o tsv)
  az webapp update --name "$app" --resource-group "$rg" --https-only true
  az webapp config set --name "$app" --resource-group "$rg" --min-tls-version 1.2
  echo "$app: HTTPS only, min TLS 1.2"
done

# Functions follow the same pattern with az functionapp update --set httpsOnly=true.

# Ratchet it shut: assign the built-in deny policy for web apps over HTTPS only.
az policy assignment create \
  --name require-https-webapp \
  --policy a4af4a39-4135-47fb-b175-47fbdf85311d \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"