Microsoft retires TLS 1.0 and 1.1 on App Service, Functions and Logic Apps in May 2027. The work isn’t flipping the setting, it’s finding every resource that still has the old minimum configured, across every subscription, before something stops negotiating.

Doing that in the portal means clicking through each resource type in each subscription. In an estate of any size that is an afternoon you will have to repeat every quarter, and you will miss things. So I wrote a PowerShell script that does it in one pass.

The complete script is on GitHub.

What it does

This script connects to your Azure tenant and scans through every subscription and resource group you have access to. It checks TLS configurations for 13 different Azure services and generates both CSV and HTML reports. The whole thing runs automatically once you kick it off.

The services covered include App Services, Function Apps, Storage Accounts, SQL Databases, PostgreSQL, MySQL, Key Vaults, Application Gateways, Front Door, API Management, Redis Cache, Cosmos DB, and Service Bus.

What you get out of it

Two artefacts, deliberately. The HTML report is what you hand to whoever asked for evidence. The CSV is what you actually work from: filter to TLS1_0 and TLS1_1, sort by subscription, and that is your remediation backlog.

The point is the inventory, not the scan. Once you have a full list you can enforce the minimum with Azure Policy instead of re-auditing by hand, and the script becomes the thing that proves the policy is holding rather than the thing that finds the drift.

How it works

The script uses the Az PowerShell module to iterate through your Azure environment systematically. For each subscription, it sets the context and then processes every resource group. Within each group, it queries specific service types and extracts their TLS configuration.

Here’s how the main loop processes subscriptions and resource groups:

Terminal window
foreach ($sub in $subscriptions) {
    Write-Output "Processing Subscription: $($sub.Name) ($($sub.Id))"


    try {
        # Set the context to the current subscription
        Set-AzContext -SubscriptionId $sub.Id -ErrorAction Stop


        # Get all resource groups in the subscription
        $resourceGroups = Get-AzResourceGroup -ErrorAction SilentlyContinue


        foreach ($rg in $resourceGroups) {
            # Process each service type...
        }
    }
    catch {
        Write-Warning "Failed to process subscription $($sub.Name): $_"
        continue
    }
}

For services like App Service and Storage Accounts, it reads the MinTlsVersion property directly. Here’s the App Service section:

Terminal window
Get-AzWebApp -ResourceGroupName $rg.ResourceGroupName -ErrorAction SilentlyContinue | ForEach-Object {
    $app = $_
    $appConfig = Get-AzWebApp -ResourceGroupName $app.ResourceGroup -Name $app.Name -ErrorAction SilentlyContinue
    # "Not Configured" means the service uses its platform default.
    # For App Service, that's TLS 1.2 since late 2023.
    $tlsVersion = if ([string]::IsNullOrEmpty($appConfig.SiteConfig.MinTlsVersion)) { "Not Configured" } else { $appConfig.SiteConfig.MinTlsVersion }
    $tlsReport.Add([PSCustomObject]@{
        ServiceName = "Azure App Service"
        ResourceName = $app.Name
        ResourceGroup = $app.ResourceGroup
        TlsVersion = $tlsVersion
        Location = $app.Location
        AdditionalInfo = "DefaultHostName: $($app.DefaultHostName); Sku: $($app.Sku.Tier); State: $($app.State)"
    })
}

For SQL servers, it checks MinimalTlsVersion. Application Gateways expose this through their SSL policy settings. The script normalizes all this data into a consistent format.

Running it

You need the Az module installed first:

Terminal window
Install-Module -Name Az -AllowClobber -Scope CurrentUser

Then just authenticate with Connect-AzAccount and run the script:

Terminal window
Connect-AzAccount -ErrorAction Stop
Get-AzureTLSReport

It will process everything it has access to and drop two files in your current directory: AzureTLSReport.csv and AzureTLSReport.html.

The HTML report includes a simple table with all the details. Service name, resource name, resource group, TLS version, location, and some additional context like SKU or state information.

Get started

Clone the repo and give it a try:

Terminal window
git clone https://github.com/Timohone/azure-tls-version-checker
cd azure-tls-version-checker

Check out the README for detailed setup instructions and examples. If you run into issues or have suggestions for improvements, open an issue on GitHub.

TLS auditing is one piece of a wider cryptographic security strategy. As quantum computing advances, knowing your current TLS posture becomes even more important. Read about quantum-safe cryptography considerations to stay ahead. For enforcing TLS requirements as part of your governance framework, Azure Policy can complement this audit script. And if you’re building a new environment, TLS enforcement should be part of your cloud foundation from day one.

Sources

  1. “TLS settings in Azure App Service,” Microsoft Learn, https://learn.microsoft.com/en-us/azure/app-service/overview-tls
  2. “Configure the minimum TLS version for a storage account,” Microsoft Learn, https://learn.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version
  3. “Azure SQL Database connectivity settings,” Microsoft Learn, https://learn.microsoft.com/en-us/azure/azure-sql/database/connectivity-settings
  4. “Install the Azure Az PowerShell module,” Microsoft Learn, https://learn.microsoft.com/en-us/powershell/azure/install-azure-powershell