TLS should be updated to the latest version for web apps

What does the recommendation "TLS should be updated to the latest version for web apps" check?

Flags any App Service web app whose minimum inbound TLS version is set below 1.2, meaning the app still accepts TLS 1.0 or 1.1 handshakes from clients. It reads the 'minTlsVersion' property on the app's site config and compares it against the current floor. The check covers inbound connections to the main app only. It does not evaluate the separate SCM/Kudu site, which has its own 'scmMinTlsVersion' setting, and it does not inspect cipher suites, certificate strength or outbound calls the app makes to other services.

Why does "TLS should be updated to the latest version for web apps" matter?

TLS 1.0 and 1.1 carry known weaknesses such as BEAST and downgrade attacks, they use deprecated cipher constructions, and they fail PCI DSS, HMG and most customer security questionnaires. An app that still negotiates them lets an attacker on the network path strip the connection down to a breakable protocol and read or tamper with traffic that the user believes is encrypted: session cookies, login credentials, personal data. Because the floor is set per app rather than inherited, one team can quietly leave an old service on 1.0 while the rest of the estate is hardened, and that single app becomes the soft target. Beyond the direct interception risk, leaving legacy TLS enabled means a single audit finding can block a release or a contract, and Microsoft is retiring inbound TLS 1.0 and 1.1 for App Service on 31 May 2027, so any app left below 1.2 will simply stop serving those clients with no warning.

How do I fix "TLS should be updated to the latest version for web apps"?

1. In the Azure portal, open the web app, go to Settings then Configuration, select the General settings tab, and set 'Minimum Inbound TLS Version' to 1.2 (or 1.3 where every client supports it).
2. To script it, run: az webapp config set --resource-group <rg> --name <app> --min-tls-version 1.2
3. Bake the floor into your Bicep so it cannot regress: on the 'Microsoft.Web/sites/config' resource (name 'web') set properties.minTlsVersion to '1.2'. Set scmMinTlsVersion to '1.2' in the same block so the deployment endpoint is covered too, since this control does not check it for you.

# Close the highest-impact plaintext doors first: the Redis non-SSL port,
# then HTTPS-only + a modern TLS floor on every web app.

# Redis: disable the non-SSL port 6379 and require TLS 1.2 (clients use 6380).
for cache in $(az redis list --query "[?enableNonSslPort].name" -o tsv); do
  rg=$(az redis list --query "[?name=='$cache'].resourceGroup" -o tsv)
  az redis update --name "$cache" --resource-group "$rg" \
    --set enableNonSslPort=false minimumTlsVersion=1.2
  echo "$cache: non-SSL port disabled, min TLS 1.2"
done

# Web apps: enforce HTTPS only and raise the TLS floor.
for app in $(az webapp list --query "[?httpsOnly==\`false\`].name" -o tsv); do
  rg=$(az webapp list --query "[?name=='$app'].resourceGroup" -o tsv)
  az webapp update --name "$app" --resource-group "$rg" --https-only true
  az webapp config set --name "$app" --resource-group "$rg" --min-tls-version 1.2
  echo "$app: HTTPS only, min TLS 1.2"
done

# Functions follow the same pattern with az functionapp update --set httpsOnly=true.

# Ratchet it shut: assign the built-in deny policy for web apps over HTTPS only.
az policy assignment create \
  --name require-https-webapp \
  --policy a4af4a39-4135-47fb-b175-47fbdf85311d \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"