Microsoft retires TLS 1.0 and 1.1 on App Service, Functions and Logic Apps in May 2027. Changing the setting is easy. The work is finding every resource that still has an old minimum configured, in every subscription.

In the portal that means going through each resource type in each subscription. In a larger estate that takes an afternoon, needs repeating every quarter, and you will miss things. So I wrote a PowerShell script that does it in one run.

The script is on GitHub.

What it does

The script goes through every subscription and resource group you have access to, reads the TLS configuration of 13 Azure services and writes a CSV and an HTML report.

Covered services: App Services, Function Apps, Storage Accounts, SQL Databases, PostgreSQL, MySQL, Key Vaults, Application Gateways, Front Door, API Management, Redis Cache, Cosmos DB and Service Bus.

The HTML report is for whoever asked for evidence. The CSV is what you work from: filter on TLS1_0 and TLS1_1, sort by subscription, and you have your remediation list.

Once you have that list, you can enforce the minimum with Azure Policy instead of auditing by hand. The script then serves to confirm the policy is working.

How it works

The script uses the Az PowerShell module. For each subscription it sets the context, then goes through every resource group and queries the supported service types:

Terminal window
foreach ($sub in $subscriptions) {
    Write-Output "Processing Subscription: $($sub.Name) ($($sub.Id))"


    try {
        # Set the context to the current subscription
        Set-AzContext -SubscriptionId $sub.Id -ErrorAction Stop


        # Get all resource groups in the subscription
        $resourceGroups = Get-AzResourceGroup -ErrorAction SilentlyContinue


        foreach ($rg in $resourceGroups) {
            # Process each service type...
        }
    }
    catch {
        Write-Warning "Failed to process subscription $($sub.Name): $_"
        continue
    }
}

For App Service and Storage Accounts it reads the MinTlsVersion property directly. The App Service part:

Terminal window
Get-AzWebApp -ResourceGroupName $rg.ResourceGroupName -ErrorAction SilentlyContinue | ForEach-Object {
    $app = $_
    $appConfig = Get-AzWebApp -ResourceGroupName $app.ResourceGroup -Name $app.Name -ErrorAction SilentlyContinue
    # "Not Configured" means the service uses its platform default.
    # For App Service, that's TLS 1.2 since late 2023.
    $tlsVersion = if ([string]::IsNullOrEmpty($appConfig.SiteConfig.MinTlsVersion)) { "Not Configured" } else { $appConfig.SiteConfig.MinTlsVersion }
    $tlsReport.Add([PSCustomObject]@{
        ServiceName = "Azure App Service"
        ResourceName = $app.Name
        ResourceGroup = $app.ResourceGroup
        TlsVersion = $tlsVersion
        Location = $app.Location
        AdditionalInfo = "DefaultHostName: $($app.DefaultHostName); Sku: $($app.Sku.Tier); State: $($app.State)"
    })
}

For SQL servers it reads MinimalTlsVersion, for Application Gateways the SSL policy. All results go into the same format.

Running it

Install the Az module:

Terminal window
Install-Module -Name Az -AllowClobber -Scope CurrentUser

Sign in and run the script:

Terminal window
Connect-AzAccount -ErrorAction Stop
Get-AzureTLSReport

It writes AzureTLSReport.csv and AzureTLSReport.html to the current directory. The HTML report is a table with service name, resource name, resource group, TLS version, location, and extra details such as SKU or state.

Get the script

Terminal window
git clone https://github.com/Timohone/azure-tls-version-checker
cd azure-tls-version-checker

The README has setup instructions and examples. Issues and suggestions are welcome on GitHub.

Knowing your TLS posture is also the starting point for post-quantum cryptography. For a new environment, TLS enforcement belongs in the cloud foundation from the start.

Sources

  1. “TLS settings in Azure App Service,” Microsoft Learn, https://learn.microsoft.com/en-us/azure/app-service/overview-tls
  2. “Configure the minimum TLS version for a storage account,” Microsoft Learn, https://learn.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version
  3. “Azure SQL Database connectivity settings,” Microsoft Learn, https://learn.microsoft.com/en-us/azure/azure-sql/database/connectivity-settings
  4. “Install the Azure Az PowerShell module,” Microsoft Learn, https://learn.microsoft.com/en-us/powershell/azure/install-azure-powershell