Secure transfer to storage accounts should be enabled

What does the recommendation "Secure transfer to storage accounts should be enabled" check?

Flags any storage account where 'Secure transfer required' is off, which means the account still accepts requests over plain HTTP as well as HTTPS. With it on, the Blob, File, Table and Queue endpoints reject any unencrypted connection.

Why does "Secure transfer to storage accounts should be enabled" matter?

A request over plain HTTP travels unencrypted, so the object data and, worse, any shared access signature token in the URL can be read or replayed by anyone able to observe the traffic. A stolen SAS token grants whatever the token allows until it expires. Requiring secure transfer closes the plain-HTTP path entirely, so credentials and data are never exposed in transit.

How do I fix "Secure transfer to storage accounts should be enabled"?

1. Set 'supportsHttpsTrafficOnly' to true on the storage account so every endpoint rejects plain HTTP.
2. Confirm any client still using an http:// endpoint is switched to https:// before you enforce, so legitimate traffic is not dropped.
3. Set a minimum TLS version of 1.2 on the account at the same time, and default both settings in your Bicep or Terraform modules.

# Close the highest-impact storage exposure first: anonymous read AND plain HTTP.
for acct in $(az storage account list \
    --query "[?allowBlobPublicAccess].name" -o tsv); do
  az storage account update --name "$acct" \
    --allow-blob-public-access false \
    --https-only true \
    --min-tls-version TLS1_2
  echo "$acct: anonymous access disabled, secure transfer required, min TLS 1.2"
done

# Ratchet it shut: deny any future account that allows anonymous access.
az policy assignment create \
  --name deny-anon-blob \
  --policy 13e6c4f1-e83f-4b50-a677-2cf6e2b9c885 \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"