Azure resources below the minimum TLS version

The minimum TLS version is the oldest protocol version a service will negotiate with a client. Older versions have known weaknesses, and Microsoft recommends requiring TLS 1.2 or later for Azure Storage and for Azure SQL (see the Microsoft Learn pages listed in the sources). If the setting is lower, a client can still connect with an outdated protocol, and you will not notice until you look at the property.

This Azure CLI script is read-only: it only runs list commands and changes nothing. Sign in with an account that has the Reader role on the subscriptions you want to check.

az login
for sub in $(az account list --query "[].id" -o tsv); do
  echo "== Subscription $sub"
  echo "-- Storage accounts: minimum TLS version"
  az storage account list --subscription "$sub" \
    --query "[].{name:name, group:resourceGroup, minimumTlsVersion:minimumTlsVersion}" -o table
  echo "-- SQL servers: minimal TLS version"
  az sql server list --subscription "$sub" \
    --query "[].{name:name, group:resourceGroup, minimalTlsVersion:minimalTlsVersion}" -o table
done

For storage accounts, the values are TLS1_0, TLS1_1 and TLS1_2; anything below TLS1_2 is a resource that still accepts an older protocol. SQL servers show the same idea in minimalTlsVersion. An empty value means no minimum is reported for that server, so confirm it in the portal's networking or connectivity settings before drawing conclusions. This script checks two resource types; other Azure services have their own TLS settings that it does not cover.

Before raising the minimum, find out which clients still connect with an older version, for example by checking the service's diagnostic logs, and upgrade those clients. Then set the minimum TLS version to the current recommendation on each resource. Raising it blocks clients that cannot negotiate the newer protocol, so change one resource at a time and confirm that your applications keep working.

ConfigCobra's Inventory & Insights lists Azure resources across your subscriptions with their security properties, including the minimum TLS version. Use the per-cloud or "All clouds" view to spot resources that fall short, follow the linked findings to the exact resource, and export to CSV. Every connected cloud is scanned automatically every day, and ConfigCobra stays read-only: it never changes your Azure.