# Ensure the web app has 'Client Certificates (Incoming client certificates)' set to 'On'

- Source: https://support.icompaas.com/support/solutions/articles/62000234761-ensure-the-web-app-has-client-certificates-incoming-client-certificates-set-to-on
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Azure Compute Services Benchmarks V1.0.0](https://support.icompaas.com/support/solutions/62000112692) › [CIS Azure compute Services](https://support.icompaas.com/support/solutions/folders/62000169260)
- Last updated: 2026-06-09
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### 

Description:

This check ensures that the web app hosted in Azure App Service is configured to require incoming client certificates for authentication. Enabling client certificates provides a secure way to authenticate clients by verifying that only those with valid certificates can access the web app.

  

Rationale:

Enabling client certificates ensures that only authenticated clients with valid certificates can connect to the web application. This method uses mutual TLS (mTLS), providing a high level of security by verifying both the server and client. It is essential for environments that require strict access control, such as financial services or government applications.

  

Impact:

This provides an additional layer of security by requiring certificates from clients for authentication, ensuring that only authorized users and systems can access the web application. It also reduces the risk of unauthorized access and protects against man-in-the-middle attacks.

  

Default Value:

By default, incoming client certificates are disabled in Azure App Service. This setting must be manually configured.

  

Pre-requisites:

-   Required permissions on the Web App (Owner / Contributor / Website Contributor).
    
-   Client certificates available.
    
-   HTTPS is enabled on the Web App.
    

  

Test Plan:

1.  Sign in to the Azure Portal.
    
2.  Navigate to App Services and select the target Web App.
    
3.  Under Settings, select Configuration.
    
4.  In the General settings tab.
    
5.  Locate Incoming client certificates.
    
6.  Verify Client Certificate Mode is set to Require.
    
7.  If Client Certificate Mode is not set to Require, follow the Implementation Steps
    

  
  

Implementation steps:

1.  Sign in to the Azure Portal.
    
2.  Navigate to App Services.
    
3.  Select the required Web App.
    

4.  Under Settings, click Configuration.
    

5.  In the General settings tab.
    
6.  Locate Incoming client certificates.
    
7.  Set Client Certificate Mode to Require.
    

8.  Click Save to apply the changes.
    

  

Backout Plan:

1.  Sign in to the Azure Portal.
    
2.  Navigate to App Services.
    
3.  Select the affected Web App.
    
4.  Under Settings, click Configuration.
    
5.  Open the General settings tab.
    
6.  Locate Incoming client certificates.
    
7.  Change Client Certificate Mode to the previous option.
    
8.  Click Save to apply the changes.
    

  

References:

-   [https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate](https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate)
    
-   [https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-identity-management](https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-identity-management)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.